Edit tour

Windows Analysis Report
LKEAHetlG6.exe

Overview

General Information

Sample name:	LKEAHetlG6.exe renamed because original name is a hash value
Original sample name:	c4f3815a85c4c42379e5a5fadeddfd6a5c412ab48b628ad6d07d85eb5827a009.exe
Analysis ID:	1487187
MD5:	56407455f0d9001e20b5bb55aacedb69
SHA1:	831304ec839bdc1fa40c71c48eb2ef3872ba28a7
SHA256:	c4f3815a85c4c42379e5a5fadeddfd6a5c412ab48b628ad6d07d85eb5827a009
Tags:	exef005-backblazeb2-com
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Found pyInstaller with non standard icon

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

LKEAHetlG6.exe (PID: 6340 cmdline: "C:\Users\user\Desktop\LKEAHetlG6.exe" MD5: 56407455F0D9001E20B5BB55AACEDB69)

conhost.exe (PID: 6984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

LKEAHetlG6.exe (PID: 7152 cmdline: "C:\Users\user\Desktop\LKEAHetlG6.exe" MD5: 56407455F0D9001E20B5BB55AACEDB69)

cmd.exe (PID: 760 cmdline: C:\Windows\system32\cmd.exe /c "kdmapper.exe drv.sys" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: LKEAHetlG6.exe

Virustotal: Detection: 12%

Perma Link

Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B800CB40 CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,EVP_MD_get0_provider,EVP_MD_free,EVP_MD_get0_provider,EVP_MD_free,EVP_CIPHER_get0_provider,EVP_CIPHER_free,EVP_MD_get0_provider,EVP_MD_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B800CB40
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8038810 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	3_2_00007FF8B8038810
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1D84 CRYPTO_free,CRYPTO_memdup,	3_2_00007FF8B7FF1D84
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8007980 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,strncmp,CRYPTO_free,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_delete,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,	3_2_00007FF8B8007980
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF107D CRYPTO_free,	3_2_00007FF8B7FF107D
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF204A CRYPTO_free,CRYPTO_malloc,ERR_new,RAND_bytes_ex,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF204A
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80159F0 CRYPTO_free,CRYPTO_free,	3_2_00007FF8B80159F0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1A16 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	3_2_00007FF8B7FF1A16
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8005A10 OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	3_2_00007FF8B8005A10
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF271B CRYPTO_free,CRYPTO_strdup,	3_2_00007FF8B7FF271B
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8047A40 CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B8047A40
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1C53 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	3_2_00007FF8B7FF1C53
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF23EC CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B7FF23EC
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF13D9 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,	3_2_00007FF8B7FF13D9
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B803DAF0 CRYPTO_free,	3_2_00007FF8B803DAF0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8015AE0 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B8015AE0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8055B10 EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	3_2_00007FF8B8055B10
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8005B10 COMP_zlib,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	3_2_00007FF8B8005B10
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8003B30 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	3_2_00007FF8B8003B30
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B805BB70 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B805BB70
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B803DB60 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B803DB60
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF222A ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,	3_2_00007FF8B7FF222A
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF267B CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	3_2_00007FF8B7FF267B
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF23E7 CRYPTO_free,CRYPTO_memdup,	3_2_00007FF8B7FF23E7
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1CEE CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	3_2_00007FF8B7FF1CEE
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF150F OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_VERIFY_PARAM_get_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	3_2_00007FF8B7FF150F
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1361 CRYPTO_malloc,EVP_PKEY_set_type,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_CTX_free,ERR_pop_to_mark,CRYPTO_free,EVP_PKEY_free,	3_2_00007FF8B7FF1361
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF5C53 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	3_2_00007FF8B7FF5C53
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF19DD BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,	3_2_00007FF8B7FF19DD
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8047CD0 CRYPTO_memcmp,	3_2_00007FF8B8047CD0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1F37 CRYPTO_malloc,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF1F37
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8015CF0 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,d2i_X509,X509_get0_pubkey,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_new,ERR_set_debug,ERR_set_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B8015CF0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1F50 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	3_2_00007FF8B7FF1F50
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8053D30 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	3_2_00007FF8B8053D30
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1CBC EVP_MD_get_size,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF1CBC
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8005D80 CRYPTO_THREAD_run_once,	3_2_00007FF8B8005D80
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF15E6 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,memcpy,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B7FF15E6
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1CE9 memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B7FF1CE9
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF16A4 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF16A4
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8011E60 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	3_2_00007FF8B8011E60
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF5E80 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	3_2_00007FF8B7FF5E80
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF24E6 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF24E6
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF3EB0 CRYPTO_free,	3_2_00007FF8B7FF3EB0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FFDEC0 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B7FFDEC0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B800BEC0 CRYPTO_free,CRYPTO_memdup,	3_2_00007FF8B800BEC0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8069F10 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B8069F10
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF236F CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF236F
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF2027 CRYPTO_free,	3_2_00007FF8B7FF2027
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1AC3 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	3_2_00007FF8B7FF1AC3
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8061F70 CRYPTO_memcmp,	3_2_00007FF8B8061F70
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1EDD CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,EVP_MD_get0_name,EVP_MD_is_a,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF1EDD
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1D8E EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,CRYPTO_zalloc,EVP_MAC_CTX_free,EVP_MAC_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_fetch,EVP_MAC_CTX_new,EVP_MAC_free,EVP_CIPHER_CTX_new,EVP_CIPHER_fetch,OSSL_PARAM_construct_utf8_string,OSSL_PARAM_construct_end,EVP_MAC_init,EVP_DecryptInit_ex,EVP_CIPHER_free,EVP_CIPHER_free,EVP_CIPHER_free,EVP_MAC_CTX_get_mac_size,EVP_CIPHER_CTX_get_iv_length,EVP_MAC_final,CRYPTO_memcmp,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_CTX_free,CRYPTO_free,	3_2_00007FF8B7FF1D8E
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FFDFB2 ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,	3_2_00007FF8B7FFDFB2
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF103C CRYPTO_malloc,COMP_expand_block,	3_2_00007FF8B7FF103C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8024000 CRYPTO_realloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B8024000
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B803E040 CRYPTO_free,	3_2_00007FF8B803E040
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1AB4 CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF1AB4
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1893 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_strdup,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF1893
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80480A0 CRYPTO_free,CRYPTO_memdup,	3_2_00007FF8B80480A0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B803E0C1 CRYPTO_free,CRYPTO_free,	3_2_00007FF8B803E0C1
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF24C8 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	3_2_00007FF8B7FF24C8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF26DF BIO_s_file,BIO_new,ERR_new,ERR_set_debug,BIO_ctrl,ERR_new,ERR_set_debug,strncmp,ERR_new,ERR_set_debug,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	3_2_00007FF8B7FF26DF
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8051126 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	3_2_00007FF8B8051126
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FFD140 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B7FFD140
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B805D170 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,	3_2_00007FF8B805D170
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF111D CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_new,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	3_2_00007FF8B7FF111D
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF20EF CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B7FF20EF
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FFB200 CRYPTO_clear_free,	3_2_00007FF8B7FFB200
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1483 CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF1483
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8053210 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	3_2_00007FF8B8053210
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF155A ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF155A
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF230B ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_new,EVP_MD_fetch,ERR_new,ERR_new,ERR_set_debug,EVP_MD_free,EVP_MD_get_size,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_free,CRYPTO_free,	3_2_00007FF8B7FF230B
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80352A0 CRYPTO_free,	3_2_00007FF8B80352A0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FFD2E1 CRYPTO_free,	3_2_00007FF8B7FFD2E1
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B803D2F0 RAND_bytes_ex,CRYPTO_malloc,memset,	3_2_00007FF8B803D2F0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1997 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_decapsulate,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	3_2_00007FF8B7FF1997
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80412E0 ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,	3_2_00007FF8B80412E0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1ED8 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_find,CRYPTO_free,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B7FF1ED8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1992 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,OPENSSL_LH_new,X509_STORE_new,CTLOG_STORE_new_ex,OPENSSL_sk_num,X509_VERIFY_PARAM_new,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,CRYPTO_secure_zalloc,RAND_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF1992
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF144C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,	3_2_00007FF8B7FF144C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1ACD ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,memcpy,ERR_new,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B7FF1ACD
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8039370 ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_set_mark,ERR_pop_to_mark,ERR_new,ERR_set_debug,ERR_clear_last_mark,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,	3_2_00007FF8B8039370
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF11BD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B7FF11BD
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8053420 ERR_new,ERR_set_debug,X509_get0_pubkey,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,CRYPTO_malloc,EVP_PKEY_encrypt_init,RAND_bytes_ex,EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	3_2_00007FF8B8053420
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF193D CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B7FF193D
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1023 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B7FF1023
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8023460 CRYPTO_malloc,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,memset,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,ERR_set_debug,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_set_mark,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B8023460
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B803F490 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B803F490
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80014E0 CRYPTO_free,CRYPTO_strndup,	3_2_00007FF8B80014E0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF12CB CRYPTO_THREAD_run_once,	3_2_00007FF8B7FF12CB
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FFF540 EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_derive_set_peer,EVP_PKEY_is_a,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_derive,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,	3_2_00007FF8B7FFF540
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8065540 CRYPTO_memcmp,	3_2_00007FF8B8065540
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80335E0 CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B80335E0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1646 EVP_MD_CTX_new,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_MD_get0_name,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,BUF_reverse,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_MD_CTX_ctrl,ERR_new,ERR_set_debug,ERR_new,EVP_DigestVerify,ERR_new,ERR_new,ERR_new,ERR_set_debug,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	3_2_00007FF8B7FF1646
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B804F660 CRYPTO_free,CRYPTO_memdup,	3_2_00007FF8B804F660
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF2522 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF2522
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF176C CRYPTO_malloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	3_2_00007FF8B7FF176C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1087 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	3_2_00007FF8B7FF1087
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8007730 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	3_2_00007FF8B8007730
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF25D6 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF25D6
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B801D750 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	3_2_00007FF8B801D750
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF108C ERR_new,ERR_set_debug,CRYPTO_free,	3_2_00007FF8B7FF108C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8047770 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B8047770
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1582 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	3_2_00007FF8B7FF1582
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8069790 EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_clear_error,ASN1_item_d2i,ASN1_TYPE_get,ERR_new,ERR_set_debug,EVP_PKEY_decrypt,ERR_new,EVP_PKEY_CTX_ctrl,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,ASN1_item_free,	3_2_00007FF8B8069790
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80097B0 CRYPTO_free,CRYPTO_strdup,	3_2_00007FF8B80097B0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FFF7F0 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,CRYPTO_malloc,EVP_PKEY_encapsulate,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_free,EVP_PKEY_CTX_free,	3_2_00007FF8B7FFF7F0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF11DB EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	3_2_00007FF8B7FF11DB
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF19E7 CRYPTO_free,	3_2_00007FF8B7FF19E7
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF162C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_DigestSignUpdate,EVP_DigestSignFinal,CRYPTO_malloc,EVP_DigestSignFinal,ERR_new,ERR_new,EVP_DigestSign,ERR_new,CRYPTO_malloc,EVP_DigestSign,BUF_reverse,ERR_new,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_MD_CTX_free,	3_2_00007FF8B7FF162C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8067820 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_new,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,ERR_new,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B8067820
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1846 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,OPENSSL_sk_push,OPENSSL_sk_num,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_value,X509_get0_pubkey,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF1846
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8059850 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B8059850
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8015870 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B8015870
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF586A BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	3_2_00007FF8B7FF586A
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80538A0 EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,	3_2_00007FF8B80538A0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF2590 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	3_2_00007FF8B7FF2590
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1B18 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_memcmp,ERR_new,ERR_new,	3_2_00007FF8B7FF1B18
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1B31 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF1B31
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B804F8F0 CRYPTO_free,CRYPTO_strndup,	3_2_00007FF8B804F8F0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1A05 ERR_new,ERR_set_debug,ERR_set_error,ASN1_item_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,_time64,X509_free,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ASN1_item_free,	3_2_00007FF8B7FF1A05
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B805A930 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	3_2_00007FF8B805A930
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF2365 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B7FF2365
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF17F8 EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key_ex,EVP_DigestSignInit_ex,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF17F8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B800E948 CRYPTO_free,	3_2_00007FF8B800E948
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1811 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	3_2_00007FF8B7FF1811
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8004980 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_snprintf,	3_2_00007FF8B8004980
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8006990 CRYPTO_THREAD_run_once,OPENSSL_sk_find,OPENSSL_sk_value,EVP_CIPHER_fetch,EVP_CIPHER_get_flags,	3_2_00007FF8B8006990
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1A32 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF1A32
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF117C _time64,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	3_2_00007FF8B7FF117C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF20E0 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF20E0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8038A90 CRYPTO_malloc,ERR_new,ERR_set_debug,	3_2_00007FF8B8038A90
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF110E EVP_PKEY_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,	3_2_00007FF8B7FF110E
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF4B10 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B7FF4B10
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF213F EVP_CIPHER_get_mode,EVP_CIPHER_get_mode,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_malloc,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF213F
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B801EB40 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,ERR_new,ERR_set_debug,CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,memcpy,	3_2_00007FF8B801EB40
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF2464 CRYPTO_memcmp,ERR_new,ERR_set_debug,memchr,ERR_new,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF2464
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1F87 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF1F87
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF4BD0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B7FF4BD0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8032C10 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	3_2_00007FF8B8032C10
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B800EC00 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	3_2_00007FF8B800EC00
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8024C28 EVP_MAC_CTX_free,CRYPTO_free,	3_2_00007FF8B8024C28
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8046C40 CRYPTO_realloc,	3_2_00007FF8B8046C40
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF11A9 EVP_MAC_CTX_free,CRYPTO_free,	3_2_00007FF8B7FF11A9
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B805ACD0 CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B805ACD0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF2112 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF2112
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8018D10 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	3_2_00007FF8B8018D10
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B801CD30 CRYPTO_THREAD_write_lock,OPENSSL_sk_new_null,OPENSSL_LH_delete,OPENSSL_sk_push,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,OPENSSL_sk_pop_free,	3_2_00007FF8B801CD30
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF21E4 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF21E4
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8050D30 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	3_2_00007FF8B8050D30
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1A23 BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	3_2_00007FF8B7FF1A23
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8028D90 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B8028D90
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FFCDC0 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	3_2_00007FF8B7FFCDC0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF195B CRYPTO_zalloc,EVP_MAC_free,EVP_MAC_CTX_free,CRYPTO_free,	3_2_00007FF8B7FF195B
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1E65 ERR_new,ERR_set_debug,CRYPTO_clear_free,	3_2_00007FF8B7FF1E65
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8040E50 CRYPTO_memcmp,	3_2_00007FF8B8040E50
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF105F ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_clear_free,	3_2_00007FF8B7FF105F
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8046E70 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B8046E70
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1677 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	3_2_00007FF8B7FF1677
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF2374 CRYPTO_free,	3_2_00007FF8B7FF2374
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8052F60 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	3_2_00007FF8B8052F60
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF4FA0 CRYPTO_free,	3_2_00007FF8B7FF4FA0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1393 OSSL_PROVIDER_do_all,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	3_2_00007FF8B7FF1393
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1B90 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	3_2_00007FF8B7FF1B90
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FFF060 CRYPTO_free,CRYPTO_memdup,	3_2_00007FF8B7FFF060
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF2121 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF2121
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1262 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	3_2_00007FF8B7FF1262
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B805B0D0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B805B0D0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B801D0C0 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	3_2_00007FF8B801D0C0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80410C0 CRYPTO_free,CRYPTO_memdup,	3_2_00007FF8B80410C0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1140 CRYPTO_free,	3_2_00007FF8B7FF1140
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8054110 ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	3_2_00007FF8B8054110
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80121C0 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	3_2_00007FF8B80121C0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80021F0 CRYPTO_THREAD_run_once,	3_2_00007FF8B80021F0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B803E200 CRYPTO_free,	3_2_00007FF8B803E200
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8034230 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,	3_2_00007FF8B8034230
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8032230 ERR_new,ERR_set_debug,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,BN_clear_free,	3_2_00007FF8B8032230
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1389 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B7FF1389
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B800E227 CRYPTO_THREAD_write_lock,	3_2_00007FF8B800E227
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF198D CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	3_2_00007FF8B7FF198D
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1401 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B7FF1401
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B803E260 CRYPTO_free,	3_2_00007FF8B803E260
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1B54 memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,memcpy,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,	3_2_00007FF8B7FF1B54
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF2180 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF2180
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B806A2C0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_set_rsa_padding,OSSL_PARAM_construct_uint,OSSL_PARAM_construct_end,EVP_PKEY_CTX_set_params,EVP_PKEY_decrypt,OPENSSL_cleanse,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_CTX_free,	3_2_00007FF8B806A2C0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80622F0 CRYPTO_free,CRYPTO_memdup,	3_2_00007FF8B80622F0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF4300 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B7FF4300
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF23D8 EVP_MD_get_size,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_clear_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF23D8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8048350 CRYPTO_free,CRYPTO_strndup,	3_2_00007FF8B8048350
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8010380 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	3_2_00007FF8B8010380
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80043A0 OPENSSL_sk_num,X509_STORE_CTX_new_ex,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_new,ERR_set_debug,ERR_set_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_new,ERR_set_debug,ERR_set_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,	3_2_00007FF8B80043A0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF25EF CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_clear_free,	3_2_00007FF8B7FF25EF
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF139D memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	3_2_00007FF8B7FF139D
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF18B6 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B7FF18B6
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1A0F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_CIPHER_get_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,CRYPTO_memcmp,ERR_set_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_pop_to_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,strncmp,strncmp,strncmp,strncmp,strncmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF1A0F
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF84B0 CRYPTO_zalloc,CRYPTO_free,	3_2_00007FF8B7FF84B0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1F23 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	3_2_00007FF8B7FF1F23
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8062510 CRYPTO_free,CRYPTO_strndup,	3_2_00007FF8B8062510
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1492 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B7FF1492
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B803E540 CRYPTO_free,	3_2_00007FF8B803E540
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8054540 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B8054540
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1488 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B7FF1488
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B803E5A0 CRYPTO_free,	3_2_00007FF8B803E5A0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80325D0 SRP_Calc_u_ex,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,BN_clear_free,BN_clear_free,	3_2_00007FF8B80325D0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B801E5E0 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	3_2_00007FF8B801E5E0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF120D EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,	3_2_00007FF8B7FF120D
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B800A600 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	3_2_00007FF8B800A600
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF114F CRYPTO_free,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF114F
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1212 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	3_2_00007FF8B7FF1212
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8038620 CRYPTO_free,	3_2_00007FF8B8038620
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF241E CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B7FF241E
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80386D0 OPENSSL_cleanse,CRYPTO_free,	3_2_00007FF8B80386D0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF26AD ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	3_2_00007FF8B7FF26AD
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF14CE CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF14CE
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80566E0 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	3_2_00007FF8B80566E0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80626E0 CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_fetch,EVP_CIPHER_get_iv_length,RAND_bytes_ex,EVP_CIPHER_free,EVP_EncryptUpdate,EVP_EncryptFinal,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get_iv_length,ERR_new,ERR_new,CRYPTO_free,EVP_CIPHER_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_CIPHER_CTX_free,	3_2_00007FF8B80626E0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1CA3 CRYPTO_strdup,CRYPTO_free,	3_2_00007FF8B7FF1CA3
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8050700 ERR_new,ERR_set_debug,CRYPTO_clear_free,	3_2_00007FF8B8050700
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF17E9 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,memcmp,ERR_new,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF17E9
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF22D4 CRYPTO_malloc,CONF_parse_list,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B7FF22D4
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1771 CRYPTO_free,	3_2_00007FF8B7FF1771
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B806A770 BN_bin2bn,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B806A770
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8004790 CRYPTO_get_ex_new_index,	3_2_00007FF8B8004790
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF17DF ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	3_2_00007FF8B7FF17DF
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80047F0 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B80047F0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8064809 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B8064809
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF136B ERR_new,ERR_set_debug,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,ERR_new,ERR_set_debug,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF136B
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF2577 ERR_new,ERR_set_debug,CRYPTO_free,BIO_clear_flags,BIO_set_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_cleanse,	3_2_00007FF8B7FF2577
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1181 CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_00007FF8B7FF1181
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF13DE EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_security_bits,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,EVP_PKEY_get_bn_param,EVP_PKEY_get_bn_param,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,ERR_set_debug,EVP_DigestSign,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_free,BN_free,BN_free,BN_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF13DE
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1A41 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	3_2_00007FF8B7FF1A41
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8F75078 i2d_X509,PyBytes_FromStringAndSize,CRYPTO_free,	3_2_00007FF8B8F75078
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8F75330 ASN1_STRING_type,ASN1_STRING_length,ASN1_STRING_get0_data,_Py_BuildValue_SizeT,ASN1_STRING_to_UTF8,_Py_Dealloc,_Py_BuildValue_SizeT,CRYPTO_free,	3_2_00007FF8B8F75330
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B93C6344 CRYPTO_memcmp,	3_2_00007FF8B93C6344
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B93C18C0 _Py_NoneStruct,_PyArg_UnpackKeywords,PyObject_GetBuffer,PyBuffer_IsContiguous,PyObject_GetBuffer,PyBuffer_IsContiguous,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,EVP_PBE_scrypt,PyBytes_FromStringAndSize,PyEval_SaveThread,EVP_PBE_scrypt,PyEval_RestoreThread,PyExc_ValueError,PyErr_SetString,PyBuffer_Release,PyBuffer_Release,PyLong_AsLong,PyErr_Occurred,PyLong_AsLong,PyErr_Occurred,PyExc_ValueError,PyExc_ValueError,PyErr_Format,_PyArg_BadArgument,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_OverflowError,PyExc_OverflowError,_Py_Dealloc,PyExc_ValueError,	3_2_00007FF8B93C18C0

Source: LKEAHetlG6.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2045072897.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041736660.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: ucrtbase.pdb source: LKEAHetlG6.exe, 00000003.00000002.2169448185.00007FF8B7EB1000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041511839.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2043710864.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044431296.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042464218.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044555266.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042075380.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044308941.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044431296.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042679757.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041341135.0000023096507000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2045398452.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042608566.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2043808210.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmp, _lzma.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042864876.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2041664235.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044308941.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2045398452.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: LKEAHetlG6.exe, 00000003.00000002.2167979262.00007FF8A8C81000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041969216.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2043710864.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2043617031.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042608566.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: LKEAHetlG6.exe, 00000000.00000003.2040248647.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2174379177.00007FF8BA253000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042397262.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2043406151.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2045299063.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042795141.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2041511839.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042326258.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042397262.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2174471307.00007FF8BA4F3000.00000002.00000001.01000000.00000008.sdmp, select.pyd.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042538640.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2043312420.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2041341135.0000023096507000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044931382.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2045496409.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2043511516.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042219020.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2043312420.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: LKEAHetlG6.exe, 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmp, libssl-3.dll.0.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044555266.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2045299063.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: LKEAHetlG6.exe, 00000003.00000002.2173899433.00007FF8B8F7D000.00000002.00000001.01000000.00000009.sdmp, _ssl.pyd.0.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044679454.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042464218.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2045195491.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: LKEAHetlG6.exe, 00000003.00000002.2167459306.00007FF8A8739000.00000002.00000001.01000000.0000000A.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2040248647.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2174379177.00007FF8BA253000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2043906573.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042075380.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2043511516.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044801944.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2041969216.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041587257.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042679757.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041664235.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2043617031.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044205408.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044931382.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2043906573.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2041439872.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2172776458.00007FF8B8CBE000.00000002.00000001.01000000.00000011.sdmp, _bz2.pyd.0.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2041587257.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.0.dr
Source:	Binary string: ucrtbase.pdbUGP source: LKEAHetlG6.exe, 00000003.00000002.2169448185.00007FF8B7EB1000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2174284082.00007FF8B9F69000.00000002.00000001.01000000.00000007.sdmp, _socket.pyd.0.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2045195491.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044205408.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2168994227.00007FF8A938F000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: LKEAHetlG6.exe, 00000003.00000002.2167459306.00007FF8A87D1000.00000002.00000001.01000000.0000000A.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: LKEAHetlG6.exe, 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmp, libssl-3.dll.0.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042864876.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2041736660.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041439872.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044093263.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044801944.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: LKEAHetlG6.exe, 00000003.00000002.2167459306.00007FF8A87D1000.00000002.00000001.01000000.0000000A.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042219020.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044679454.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2045496409.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2043808210.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2043406151.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041808714.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmp, _lzma.pyd.0.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042326258.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2174196234.00007FF8B9843000.00000002.00000001.01000000.0000000D.sdmp, _queue.pyd.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042538640.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2045072897.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042795141.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044093263.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr

Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D67990 FindFirstFileExW,FindClose,	0_2_00007FF7E5D67990
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D66C30 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7E5D66C30
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D81C04 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7E5D81C04
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D67990 FindFirstFileExW,FindClose,	3_2_00007FF7E5D67990
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D66C30 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_00007FF7E5D66C30
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D81C04 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00007FF7E5D81C04
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E6EFEC FindFirstFileExW,FindClose,FindNextFileW,	3_2_00007FF8B7E6EFEC
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E42DFC FindFirstFileExW,	3_2_00007FF8B7E42DFC

Source: Joe Sandbox View

IP Address: 149.137.136.16 149.137.136.16

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: f005.backblazeb2.com

Source: LKEAHetlG6.exe, 00000003.00000002.2163729882.0000021EF3D70000.00000004.00001000.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2089157925.0000021EF3FE5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070891070.0000021EF3FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096511000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041225740.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000002.2174859124.0000023096511000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041341135.000002309650D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2050082495.0000023096504000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041225740.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041341135.000002309650D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041439872.000002309650E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2050082495.0000023096504000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041225740.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2050082495.0000023096504000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _queue.pyd.0.dr, libssl-3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096511000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041225740.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000002.2174859124.0000023096511000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2050082495.0000023096504000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: LKEAHetlG6.exe, 00000003.00000003.2155930267.0000021EF411B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154248967.0000021EF4108000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157235980.0000021EF3871000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155425564.0000021EF410C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: LKEAHetlG6.exe, 00000003.00000003.2152436559.0000021EF3F02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154441116.0000021EF3EAE000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157170637.0000021EF3F08000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157589293.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153283109.0000021EF3EAD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165252524.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152029123.0000021EF3EF0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152168709.0000021EF3EA5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155878335.0000021EF3EAF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154926282.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153045508.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153503679.0000021EF3ED6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156802569.0000021EF3EDA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154542353.0000021EF3ED7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153283109.0000021EF3EAD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152168709.0000021EF3EA5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: LKEAHetlG6.exe, 00000003.00000003.2157235980.0000021EF3871000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: LKEAHetlG6.exe, 00000003.00000003.2153503679.0000021EF3ED6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156802569.0000021EF3EDA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154542353.0000021EF3ED7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153283109.0000021EF3EAD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152168709.0000021EF3EA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl6
Source: LKEAHetlG6.exe, 00000003.00000003.2155930267.0000021EF411B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154248967.0000021EF4108000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157235980.0000021EF3871000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155425564.0000021EF410C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl&
Source: LKEAHetlG6.exe, 00000003.00000003.2156370154.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: LKEAHetlG6.exe, 00000003.00000003.2156370154.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: LKEAHetlG6.exe, 00000003.00000003.2152436559.0000021EF3F02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157170637.0000021EF3F08000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152029123.0000021EF3EF0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154926282.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153045508.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096511000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041225740.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000002.2174859124.0000023096511000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041341135.000002309650D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2050082495.0000023096504000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041225740.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041341135.000002309650D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041439872.000002309650E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2050082495.0000023096504000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041225740.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2050082495.0000023096504000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _queue.pyd.0.dr, libssl-3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _lzma.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041225740.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041341135.000002309650D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041439872.000002309650E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2050082495.0000023096504000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: LKEAHetlG6.exe, 00000003.00000003.2152436559.0000021EF3F02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157170637.0000021EF3F08000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165368085.0000021EF3F10000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070084203.0000021EF3F3C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070891070.0000021EF3F3E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152029123.0000021EF3EF0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3F3C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154926282.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153045508.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165839985.0000021EF427C000.00000004.00001000.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: LKEAHetlG6.exe, 00000003.00000003.2152061445.0000021EF35C6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154817772.0000021EF35D2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156622175.0000021EF35D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3ED2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069500003.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153503679.0000021EF3ED6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153283109.0000021EF3EAD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153995890.0000021EF3EEE000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152168709.0000021EF3EA5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: LKEAHetlG6.exe, 00000003.00000003.2153309139.0000021EF359B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2089470414.0000021EF39A5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2163322872.0000021EF39E7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154668634.0000021EF39D1000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2160404641.0000021EF39E3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2151634462.0000021EF39A7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152949314.0000021EF39C1000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161678266.0000021EF39E6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154612082.0000021EF39CF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153521804.0000021EF39CE000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155705158.0000021EF39D4000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068235580.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: LKEAHetlG6.exe, 00000003.00000003.2154441116.0000021EF3EAE000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157589293.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153283109.0000021EF3EAD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165252524.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152168709.0000021EF3EA5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155878335.0000021EF3EAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: LKEAHetlG6.exe, 00000003.00000003.2155067013.0000021EF40DF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155560449.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165602889.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155088852.0000021EF4103000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: LKEAHetlG6.exe, 00000003.00000003.2154441116.0000021EF3EAE000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157589293.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153283109.0000021EF3EAD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165252524.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152168709.0000021EF3EA5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155878335.0000021EF3EAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.esy
Source: LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.di
Source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041225740.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041341135.000002309650D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041439872.000002309650E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2050082495.0000023096504000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096511000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041225740.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000002.2174859124.0000023096511000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2050082495.0000023096504000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096511000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041225740.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000002.2174859124.0000023096511000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041341135.000002309650D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2050082495.0000023096504000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041225740.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2050082495.0000023096504000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _queue.pyd.0.dr, libssl-3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: LKEAHetlG6.exe, 00000003.00000003.2161365714.0000021EF40B6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156995241.0000021EF40A9000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154646537.0000021EF38E8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157627855.0000021EF3907000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165541332.0000021EF40C1000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161345104.0000021EF40AC000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152384924.0000021EF38E7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157294454.0000021EF38FF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152311361.0000021EF38D8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161467423.0000021EF40BC000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157217178.0000021EF38EF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161384766.0000021EF40BB000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/z
Source: LKEAHetlG6.exe, 00000003.00000002.2163729882.0000021EF3D70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: LKEAHetlG6.exe, 00000003.00000003.2155067013.0000021EF40DF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154441116.0000021EF3EAE000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155560449.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165602889.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157589293.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153283109.0000021EF3EAD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165252524.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152168709.0000021EF3EA5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155878335.0000021EF3EAF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155088852.0000021EF4103000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: LKEAHetlG6.exe, 00000003.00000003.2155067013.0000021EF40DF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155425564.0000021EF40E3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: LKEAHetlG6.exe, 00000003.00000003.2155067013.0000021EF40DF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155199818.0000021EF40EC000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: LKEAHetlG6.exe, 00000003.00000003.2155067013.0000021EF40DF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155560449.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165602889.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155088852.0000021EF4103000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: LKEAHetlG6.exe, 00000003.00000003.2155067013.0000021EF40DF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155560449.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165602889.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155199818.0000021EF40EC000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155088852.0000021EF4103000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: LKEAHetlG6.exe, 00000003.00000003.2157771510.0000021EF3E81000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154248967.0000021EF4108000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156208856.0000021EF4132000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161212232.0000021EF4132000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155150281.0000021EF411E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155288495.0000021EF4131000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156370154.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: LKEAHetlG6.exe, 00000003.00000003.2157771510.0000021EF3E81000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156370154.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/w
Source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041225740.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2047623118.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041341135.000002309650D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041439872.000002309650E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000000.00000003.2050082495.0000023096504000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: LKEAHetlG6.exe, 00000003.00000003.2151860384.0000021EF3F9D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2090100081.0000021EF3F9D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155306056.0000021EF40C8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152714757.0000021EF3F9D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165563791.0000021EF40C8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156401092.0000021EF3FA2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: LKEAHetlG6.exe, 00000003.00000003.2153488736.0000021EF3A02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2089883248.0000021EF39F3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF39F3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2151634462.0000021EF39F3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152949314.0000021EF39F3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068235580.0000021EF39F3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068235580.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: LKEAHetlG6.exe, 00000003.00000003.2161365714.0000021EF40B6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156995241.0000021EF40A9000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161345104.0000021EF40AC000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161467423.0000021EF40BC000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161384766.0000021EF40BB000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155306056.0000021EF40C8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165563791.0000021EF40C8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: LKEAHetlG6.exe, 00000003.00000003.2154441116.0000021EF3EAE000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069500003.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157589293.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070084203.0000021EF3F3C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070891070.0000021EF3F3E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153283109.0000021EF3EAD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165252524.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3F3C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152168709.0000021EF3EA5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155878335.0000021EF3EAF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: LKEAHetlG6.exe, 00000003.00000003.2089470414.0000021EF39A5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2066182430.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2151634462.0000021EF39A7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152949314.0000021EF39C1000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068235580.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: LKEAHetlG6.exe, 00000003.00000003.2061790031.0000021EF35BE000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2063791387.0000021EF3550000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162261698.0000021EF33D0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: LKEAHetlG6.exe, 00000003.00000002.2162261698.0000021EF3350000.00000004.00001000.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://f005.backblazeb2.com/file/exefiles-storage/1/drv.sys
Source: LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://f005.backblazeb2.com/file/exefiles-storage/1/drv.sys__
Source: LKEAHetlG6.exe, 00000003.00000002.2162261698.0000021EF3350000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://f005.backblazeb2.com/file/exefiles-storage/1/drv.syspydd
Source: LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4410000.00000004.00001000.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162261698.0000021EF33D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://f005.backblazeb2.com/file/exefiles-storage/2/kdmapper.exe
Source: LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://f005.backblazeb2.com/file/exefiles-storage/2/kdmapper.exeP
Source: LKEAHetlG6.exe, 00000003.00000002.2162261698.0000021EF33D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://f005.backblazeb2.com/file/exefiles-storage/2/kdmapper.exetionsP
Source: LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3ED2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069500003.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2163655584.0000021EF3C70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: LKEAHetlG6.exe, 00000003.00000003.2152436559.0000021EF3F02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165388705.0000021EF3F1C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068671868.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158125827.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153417535.0000021EF3F17000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157755598.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152029123.0000021EF3EF0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156569932.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152550892.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068756810.0000021EF3F17000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068564281.0000021EF3F11000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: LKEAHetlG6.exe, 00000003.00000003.2157927673.0000021EF1ACD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2062877388.0000021EF1A7E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158623728.0000021EF3545000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158514491.0000021EF1ACF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2061950412.0000021EF355B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156540490.0000021EF3541000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158659929.0000021EF354F000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2063791387.0000021EF355B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152607937.0000021EF1AB2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152242908.0000021EF1AAF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162471442.0000021EF355C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158888967.0000021EF1AD0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152136896.0000021EF1AA3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: LKEAHetlG6.exe, 00000003.00000002.2162261698.0000021EF3350000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: LKEAHetlG6.exe, 00000003.00000003.2157927673.0000021EF1ACD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2062877388.0000021EF1A7E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158623728.0000021EF3545000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158514491.0000021EF1ACF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2061950412.0000021EF355B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156540490.0000021EF3541000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158659929.0000021EF354F000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2063791387.0000021EF355B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2159150958.0000021EF1AD1000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162199260.0000021EF1AD1000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152607937.0000021EF1AB2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152242908.0000021EF1AAF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162471442.0000021EF355C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158888967.0000021EF1AD0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152136896.0000021EF1AA3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: LKEAHetlG6.exe, 00000003.00000003.2065201080.0000021EF399C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068489279.0000021EF3880000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2066701059.0000021EF3880000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2066391193.0000021EF3880000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2065341640.0000021EF359E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152384924.0000021EF38E7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152311361.0000021EF38D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: LKEAHetlG6.exe, 00000003.00000003.2157927673.0000021EF1ACD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2062877388.0000021EF1A7E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158623728.0000021EF3545000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158514491.0000021EF1ACF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2061950412.0000021EF355B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156540490.0000021EF3541000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158659929.0000021EF354F000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2063791387.0000021EF355B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152607937.0000021EF1AB2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152242908.0000021EF1AAF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162471442.0000021EF355C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158888967.0000021EF1AD0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152136896.0000021EF1AA3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3ED2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069500003.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2163655584.0000021EF3C70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: LKEAHetlG6.exe, 00000003.00000003.2152436559.0000021EF3F02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068671868.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152029123.0000021EF3EF0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161546329.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154926282.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165347108.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068756810.0000021EF3F17000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153045508.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068564281.0000021EF3F11000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: LKEAHetlG6.exe, 00000003.00000002.2165839985.0000021EF427C000.00000004.00001000.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154891725.0000021EF39A7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068235580.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156602962.0000021EF358C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: LKEAHetlG6.exe, 00000003.00000003.2152436559.0000021EF3F02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2089470414.0000021EF39A5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157170637.0000021EF3F08000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156456390.0000021EF39BB000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068671868.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158125827.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153417535.0000021EF3F17000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157755598.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2151634462.0000021EF39A7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152029123.0000021EF3EF0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154926282.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156569932.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152550892.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068756810.0000021EF3F17000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153045508.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068564281.0000021EF3F11000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: LKEAHetlG6.exe, 00000003.00000003.2152489145.0000021EF3915000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2163084099.0000021EF3924000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2160759120.0000021EF3924000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2090075701.0000021EF390F000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068235580.0000021EF390E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152384924.0000021EF38E7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152311361.0000021EF38D8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153402815.0000021EF3923000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152534781.0000021EF391D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF3907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: LKEAHetlG6.exe, 00000003.00000003.2156602962.0000021EF358C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4370000.00000004.00001000.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162494798.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154296731.0000021EF3584000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2160226830.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158235787.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158994936.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155102834.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF3907000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071262885.0000021EF3A11000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068235580.0000021EF3A11000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158094967.0000021EF3A19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: LKEAHetlG6.exe, 00000003.00000002.2162862367.0000021EF387C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3E81000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157235980.0000021EF3871000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157488779.0000021EF3878000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068986087.0000021EF3F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: LKEAHetlG6.exe, 00000003.00000002.2162751342.0000021EF3770000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: LKEAHetlG6.exe, 00000003.00000002.2167979262.00007FF8A8C81000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162494798.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154296731.0000021EF3584000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2160226830.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4410000.00000004.00001000.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158235787.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158994936.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155102834.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: LKEAHetlG6.exe, 00000003.00000003.2157278979.0000021EF38E9000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068489279.0000021EF3880000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154646537.0000021EF38E8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152384924.0000021EF38E7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152311361.0000021EF38D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: LKEAHetlG6.exe, 00000003.00000003.2066346334.0000021EF35D6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2066626111.0000021EF35D6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152061445.0000021EF35E5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153076909.0000021EF35E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: LKEAHetlG6.exe, 00000003.00000003.2152436559.0000021EF3F02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068671868.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152029123.0000021EF3EF0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154296731.0000021EF3584000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152550892.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156569932.0000021EF3F16000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068564281.0000021EF3F11000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155102834.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156602962.0000021EF358C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: LKEAHetlG6.exe, 00000003.00000002.2163729882.0000021EF3D70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: LKEAHetlG6.exe, 00000003.00000002.2163729882.0000021EF3D70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmp, LKEAHetlG6.exe, 00000003.00000002.2167716527.00007FF8A887A000.00000002.00000001.01000000.0000000A.sdmp, libcrypto-3.dll.0.dr, libssl-3.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162494798.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154296731.0000021EF3584000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2160226830.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158235787.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158994936.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155102834.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3E81000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157235980.0000021EF3871000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068986087.0000021EF3F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: LKEAHetlG6.exe, 00000003.00000002.2168429309.00007FF8A8DF8000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: LKEAHetlG6.exe, 00000003.00000002.2167979262.00007FF8A8C81000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: LKEAHetlG6.exe, 00000003.00000003.2068489279.0000021EF3880000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154646537.0000021EF38E8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152384924.0000021EF38E7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157294454.0000021EF38FF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152311361.0000021EF38D8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157217178.0000021EF38EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: LKEAHetlG6.exe, 00000003.00000003.2155945272.0000021EF4135000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154248967.0000021EF4108000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155150281.0000021EF411E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155288495.0000021EF4131000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: LKEAHetlG6.exe, 00000003.00000003.2157235980.0000021EF3871000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: LKEAHetlG6.exe, 00000003.00000003.2155945272.0000021EF4135000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154248967.0000021EF4108000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155150281.0000021EF411E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155288495.0000021EF4131000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/4%e
Source: LKEAHetlG6.exe, 00000003.00000003.2152436559.0000021EF3F02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2089470414.0000021EF39A5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157170637.0000021EF3F08000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156456390.0000021EF39BB000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068671868.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158125827.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153417535.0000021EF3F17000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157755598.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2151634462.0000021EF39A7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152029123.0000021EF3EF0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154926282.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156569932.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152550892.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068756810.0000021EF3F17000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153045508.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068564281.0000021EF3F11000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D85F90	0_2_00007FF7E5D85F90
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D86CF4	0_2_00007FF7E5D86CF4
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D67F10	0_2_00007FF7E5D67F10
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D70688	0_2_00007FF7E5D70688
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D6FE68	0_2_00007FF7E5D6FE68
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D75E00	0_2_00007FF7E5D75E00
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D735A0	0_2_00007FF7E5D735A0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D71570	0_2_00007FF7E5D71570
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D7DD34	0_2_00007FF7E5D7DD34
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D71908	0_2_00007FF7E5D71908
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D730DC	0_2_00007FF7E5D730DC
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D728A0	0_2_00007FF7E5D728A0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D7088C	0_2_00007FF7E5D7088C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D7006C	0_2_00007FF7E5D7006C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D7E848	0_2_00007FF7E5D7E848
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D787E8	0_2_00007FF7E5D787E8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D83FA0	0_2_00007FF7E5D83FA0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D867A8	0_2_00007FF7E5D867A8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D80C58	0_2_00007FF7E5D80C58
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D79F30	0_2_00007FF7E5D79F30
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D89AB8	0_2_00007FF7E5D89AB8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D70278	0_2_00007FF7E5D70278
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D8620C	0_2_00007FF7E5D8620C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D689EB	0_2_00007FF7E5D689EB
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D7E1C8	0_2_00007FF7E5D7E1C8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D78130	0_2_00007FF7E5D78130
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D72CD8	0_2_00007FF7E5D72CD8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D7047C	0_2_00007FF7E5D7047C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D80C58	0_2_00007FF7E5D80C58
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D8443C	0_2_00007FF7E5D8443C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D81C04	0_2_00007FF7E5D81C04
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D693BD	0_2_00007FF7E5D693BD
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D68B8B	0_2_00007FF7E5D68B8B
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D85F90	3_2_00007FF7E5D85F90
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D86CF4	3_2_00007FF7E5D86CF4
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D67F10	3_2_00007FF7E5D67F10
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D70688	3_2_00007FF7E5D70688
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D6FE68	3_2_00007FF7E5D6FE68
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D75E00	3_2_00007FF7E5D75E00
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D735A0	3_2_00007FF7E5D735A0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D71570	3_2_00007FF7E5D71570
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D7DD34	3_2_00007FF7E5D7DD34
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D71908	3_2_00007FF7E5D71908
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D730DC	3_2_00007FF7E5D730DC
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D728A0	3_2_00007FF7E5D728A0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D7088C	3_2_00007FF7E5D7088C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D7006C	3_2_00007FF7E5D7006C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D7E848	3_2_00007FF7E5D7E848
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D787E8	3_2_00007FF7E5D787E8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D83FA0	3_2_00007FF7E5D83FA0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D867A8	3_2_00007FF7E5D867A8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D80C58	3_2_00007FF7E5D80C58
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D79F30	3_2_00007FF7E5D79F30
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D89AB8	3_2_00007FF7E5D89AB8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D70278	3_2_00007FF7E5D70278
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D8620C	3_2_00007FF7E5D8620C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D689EB	3_2_00007FF7E5D689EB
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D7E1C8	3_2_00007FF7E5D7E1C8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D78130	3_2_00007FF7E5D78130
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D72CD8	3_2_00007FF7E5D72CD8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D7047C	3_2_00007FF7E5D7047C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D80C58	3_2_00007FF7E5D80C58
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D8443C	3_2_00007FF7E5D8443C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D81C04	3_2_00007FF7E5D81C04
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D693BD	3_2_00007FF7E5D693BD
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D68B8B	3_2_00007FF7E5D68B8B
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8A9281880	3_2_00007FF8A9281880
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8A92812F0	3_2_00007FF8A92812F0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E6E864	3_2_00007FF8B7E6E864
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E087D0	3_2_00007FF8B7E087D0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E157B8	3_2_00007FF8B7E157B8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E14788	3_2_00007FF8B7E14788
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E646F8	3_2_00007FF8B7E646F8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E2D6E0	3_2_00007FF8B7E2D6E0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E026A0	3_2_00007FF8B7E026A0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E1C6B0	3_2_00007FF8B7E1C6B0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E42694	3_2_00007FF8B7E42694
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E08650	3_2_00007FF8B7E08650
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E20580	3_2_00007FF8B7E20580
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E2C570	3_2_00007FF8B7E2C570
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E2654C	3_2_00007FF8B7E2654C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E1641C	3_2_00007FF8B7E1641C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E1D408	3_2_00007FF8B7E1D408
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E0A400	3_2_00007FF8B7E0A400
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E122F0	3_2_00007FF8B7E122F0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E022A4	3_2_00007FF8B7E022A4
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E8B2AC	3_2_00007FF8B7E8B2AC
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E0423C	3_2_00007FF8B7E0423C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E09120	3_2_00007FF8B7E09120
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E0B0B0	3_2_00007FF8B7E0B0B0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E0A030	3_2_00007FF8B7E0A030
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E03000	3_2_00007FF8B7E03000
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E1CEC0	3_2_00007FF8B7E1CEC0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E42EC0	3_2_00007FF8B7E42EC0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E6CEC0	3_2_00007FF8B7E6CEC0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E08EA0	3_2_00007FF8B7E08EA0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E6EE44	3_2_00007FF8B7E6EE44
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E16E30	3_2_00007FF8B7E16E30
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E2BE10	3_2_00007FF8B7E2BE10
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E6DDF0	3_2_00007FF8B7E6DDF0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E28D50	3_2_00007FF8B7E28D50
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E08D30	3_2_00007FF8B7E08D30
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7EA5CC0	3_2_00007FF8B7EA5CC0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E3ACC4	3_2_00007FF8B7E3ACC4
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E1DC60	3_2_00007FF8B7E1DC60
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E0DC30	3_2_00007FF8B7E0DC30
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E0BBB0	3_2_00007FF8B7E0BBB0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E02B90	3_2_00007FF8B7E02B90
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E2AB55	3_2_00007FF8B7E2AB55
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E01AF8	3_2_00007FF8B7E01AF8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E1CAE4	3_2_00007FF8B7E1CAE4
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E6EA3C	3_2_00007FF8B7E6EA3C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E05A20	3_2_00007FF8B7E05A20
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E03984	3_2_00007FF8B7E03984
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E1195E	3_2_00007FF8B7E1195E
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7EA495C	3_2_00007FF8B7EA495C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1596	3_2_00007FF8B7FF1596
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF21DF	3_2_00007FF8B7FF21DF
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1AD7	3_2_00007FF8B7FF1AD7
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8069B30	3_2_00007FF8B8069B30
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8015CF0	3_2_00007FF8B8015CF0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1CBC	3_2_00007FF8B7FF1CBC
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1EDD	3_2_00007FF8B7FF1EDD
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1D8E	3_2_00007FF8B7FF1D8E
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF155A	3_2_00007FF8B7FF155A
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B803D2F0	3_2_00007FF8B803D2F0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8039370	3_2_00007FF8B8039370
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1FD7	3_2_00007FF8B7FF1FD7
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B801B700	3_2_00007FF8B801B700
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8035770	3_2_00007FF8B8035770
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B803D7C0	3_2_00007FF8B803D7C0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1546	3_2_00007FF8B7FF1546
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF17F8	3_2_00007FF8B7FF17F8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1618	3_2_00007FF8B7FF1618
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF2612	3_2_00007FF8B7FF2612
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF26FD	3_2_00007FF8B7FF26FD
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF117C	3_2_00007FF8B7FF117C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF24D7	3_2_00007FF8B7FF24D7
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF149C	3_2_00007FF8B7FF149C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF21C1	3_2_00007FF8B7FF21C1
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1C12	3_2_00007FF8B7FF1C12
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80070B0	3_2_00007FF8B80070B0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF116D	3_2_00007FF8B7FF116D
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1B54	3_2_00007FF8B7FF1B54
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80283F0	3_2_00007FF8B80283F0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF1A0F	3_2_00007FF8B7FF1A0F
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B805C530	3_2_00007FF8B805C530
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF16FE	3_2_00007FF8B7FF16FE
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF8630	3_2_00007FF8B7FF8630
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B80626E0	3_2_00007FF8B80626E0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF143D	3_2_00007FF8B7FF143D
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF13DE	3_2_00007FF8B7FF13DE
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8B21920	3_2_00007FF8B8B21920
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8B2FA88	3_2_00007FF8B8B2FA88
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8B212B0	3_2_00007FF8B8B212B0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8B21A00	3_2_00007FF8B8B21A00
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8B223B0	3_2_00007FF8B8B223B0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8B273F8	3_2_00007FF8B8B273F8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8B255D0	3_2_00007FF8B8B255D0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8B24650	3_2_00007FF8B8B24650
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8B22F80	3_2_00007FF8B8B22F80
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8B28F40	3_2_00007FF8B8B28F40
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8B25F00	3_2_00007FF8B8B25F00
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8CB2DC0	3_2_00007FF8B8CB2DC0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8CB3DC0	3_2_00007FF8B8CB3DC0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8CB77E8	3_2_00007FF8B8CB77E8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8CB6080	3_2_00007FF8B8CB6080
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8CBC9AE	3_2_00007FF8B8CBC9AE
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8CB1000	3_2_00007FF8B8CB1000
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8CB3B20	3_2_00007FF8B8CB3B20
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8CE0980	3_2_00007FF8B8CE0980
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8CDC480	3_2_00007FF8B8CDC480
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8F78E7C	3_2_00007FF8B8F78E7C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8F75C10	3_2_00007FF8B8F75C10
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8F7543C	3_2_00007FF8B8F7543C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8F7BCB8	3_2_00007FF8B8F7BCB8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8F78778	3_2_00007FF8B8F78778
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8F79F8C	3_2_00007FF8B8F79F8C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8F79B94	3_2_00007FF8B8F79B94
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B93C18C0	3_2_00007FF8B93C18C0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B93C1580	3_2_00007FF8B93C1580
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B93C11A0	3_2_00007FF8B93C11A0

Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: String function: 00007FF8B806C931 appears 39 times
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: String function: 00007FF7E5D61DB0 appears 36 times
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: String function: 00007FF8B806C93D appears 69 times
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: String function: 00007FF8B806C265 appears 48 times
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: String function: 00007FF8B8CD3800 appears 51 times
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: String function: 00007FF7E5D61DF0 appears 110 times
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: String function: 00007FF8B7E06448 appears 32 times
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: String function: 00007FF8B8CD3880 appears 114 times
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: String function: 00007FF8B806C17B appears 38 times
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: String function: 00007FF8B806C181 appears 1188 times
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: String function: 00007FF8B7FF1325 appears 477 times
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: String function: 00007FF8B806C16F appears 335 times

Source: unicodedata.pyd.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found

Source: LKEAHetlG6.exe, 00000000.00000003.2042608566.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2045072897.0000023096502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2045195491.0000023096502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2052414447.0000023096504000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2042075380.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2041808714.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2044801944.0000023096502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2041587257.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2041664235.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2042864876.0000023096509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2045299063.0000023096502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2044555266.0000023096509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2041225740.0000023096500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2044431296.0000023096502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2044093263.0000023096509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2041969216.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2042679757.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2042538640.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2042795141.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2040248647.0000023096500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2043511516.0000023096502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2043617031.0000023096509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2042219020.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2043906573.0000023096509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2044679454.0000023096509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2041736660.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2041341135.0000023096507000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2045398452.0000023096502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2045496409.0000023096509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2043808210.0000023096509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2043710864.0000023096509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2044205408.0000023096502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2044308941.0000023096509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2042326258.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2041439872.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2043406151.0000023096509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2044931382.0000023096509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2042464218.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2043312420.0000023096509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2042397262.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000000.00000003.2041511839.0000023096501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe	Binary or memory string: OriginalFilename vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamelibsslH vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000003.00000002.2174319279.00007FF8B9F73000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000003.00000002.2174509645.00007FF8BA4F6000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000003.00000002.2174417821.00007FF8BA259000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000003.00000002.2173451323.00007FF8B8CC3000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000003.00000002.2168895294.00007FF8A8F20000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000003.00000002.2169276377.00007FF8A9394000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000003.00000002.2173978125.00007FF8B8F99000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000003.00000002.2169506454.00007FF8B7EEC000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000003.00000002.2167716527.00007FF8A887A000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs LKEAHetlG6.exe
Source: LKEAHetlG6.exe, 00000003.00000002.2174231009.00007FF8B9846000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs LKEAHetlG6.exe

Source: classification engine

Classification label: mal52.winEXE@6/56@1/1

Source: C:\Users\user\Desktop\LKEAHetlG6.exe

Code function: 0_2_00007FF7E5D61ED0 GetLastError,FormatMessageW,

0_2_00007FF7E5D61ED0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6984:120:WilError_03

Source: C:\Users\user\Desktop\LKEAHetlG6.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI63402

Jump to behavior

Source: LKEAHetlG6.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\LKEAHetlG6.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LKEAHetlG6.exe

Virustotal: Detection: 12%

Source: C:\Users\user\Desktop\LKEAHetlG6.exe

File read: C:\Users\user\Desktop\LKEAHetlG6.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LKEAHetlG6.exe "C:\Users\user\Desktop\LKEAHetlG6.exe"
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Process created: C:\Users\user\Desktop\LKEAHetlG6.exe "C:\Users\user\Desktop\LKEAHetlG6.exe"
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "kdmapper.exe drv.sys"
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Process created: C:\Users\user\Desktop\LKEAHetlG6.exe "C:\Users\user\Desktop\LKEAHetlG6.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "kdmapper.exe drv.sys"	Jump to behavior

Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: LKEAHetlG6.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: LKEAHetlG6.exe

Static file information: File size 9300301 > 1048576

Source: LKEAHetlG6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: LKEAHetlG6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: LKEAHetlG6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: LKEAHetlG6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: LKEAHetlG6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: LKEAHetlG6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: LKEAHetlG6.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: LKEAHetlG6.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2045072897.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041736660.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: ucrtbase.pdb source: LKEAHetlG6.exe, 00000003.00000002.2169448185.00007FF8B7EB1000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041511839.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2043710864.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044431296.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042464218.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044555266.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042075380.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044308941.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044431296.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042679757.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041341135.0000023096507000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2045398452.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042608566.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2043808210.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmp, _lzma.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042864876.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2041664235.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044308941.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2045398452.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: LKEAHetlG6.exe, 00000003.00000002.2167979262.00007FF8A8C81000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041969216.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2043710864.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2043617031.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042608566.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: LKEAHetlG6.exe, 00000000.00000003.2040248647.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2174379177.00007FF8BA253000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042397262.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2043406151.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2045299063.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042795141.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2041511839.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042326258.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042397262.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: LKEAHetlG6.exe, 00000000.00000003.2052221560.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2174471307.00007FF8BA4F3000.00000002.00000001.01000000.00000008.sdmp, select.pyd.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042538640.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2043312420.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2041341135.0000023096507000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044931382.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2045496409.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2043511516.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042219020.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2043312420.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: LKEAHetlG6.exe, 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmp, libssl-3.dll.0.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044555266.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2045299063.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: LKEAHetlG6.exe, 00000003.00000002.2173899433.00007FF8B8F7D000.00000002.00000001.01000000.00000009.sdmp, _ssl.pyd.0.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044679454.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042464218.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2045195491.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: LKEAHetlG6.exe, 00000003.00000002.2167459306.00007FF8A8739000.00000002.00000001.01000000.0000000A.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2040248647.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2174379177.00007FF8BA253000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2043906573.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042075380.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2043511516.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044801944.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2041969216.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041587257.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042679757.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: LKEAHetlG6.exe, 00000000.00000003.2040753019.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041664235.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2043617031.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044205408.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044931382.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2043906573.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2041439872.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: LKEAHetlG6.exe, 00000000.00000003.2040437249.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2172776458.00007FF8B8CBE000.00000002.00000001.01000000.00000011.sdmp, _bz2.pyd.0.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2041587257.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.0.dr
Source:	Binary string: ucrtbase.pdbUGP source: LKEAHetlG6.exe, 00000003.00000002.2169448185.00007FF8B7EB1000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041116513.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2174284082.00007FF8B9F69000.00000002.00000001.01000000.00000007.sdmp, _socket.pyd.0.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2045195491.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044205408.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: LKEAHetlG6.exe, 00000000.00000003.2053386902.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2168994227.00007FF8A938F000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: LKEAHetlG6.exe, 00000003.00000002.2167459306.00007FF8A87D1000.00000002.00000001.01000000.0000000A.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: LKEAHetlG6.exe, 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmp, libssl-3.dll.0.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042864876.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2041736660.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041439872.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044093263.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2044801944.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: LKEAHetlG6.exe, 00000003.00000002.2167459306.00007FF8A87D1000.00000002.00000001.01000000.0000000A.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042219020.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044679454.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2045496409.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2043808210.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2043406151.0000023096509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041808714.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: LKEAHetlG6.exe, 00000000.00000003.2040859895.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmp, _lzma.pyd.0.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: LKEAHetlG6.exe, 00000000.00000003.2042326258.0000023096501000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: LKEAHetlG6.exe, 00000000.00000003.2041047592.0000023096500000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2174196234.00007FF8B9843000.00000002.00000001.01000000.0000000D.sdmp, _queue.pyd.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042538640.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2045072897.0000023096502000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2042795141.0000023096501000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: LKEAHetlG6.exe, 00000000.00000003.2044093263.0000023096509000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr

Source: LKEAHetlG6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: LKEAHetlG6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: LKEAHetlG6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: LKEAHetlG6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: LKEAHetlG6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: api-ms-win-crt-time-l1-1-0.dll.0.dr

Static PE information: 0x86AADB47 [Mon Aug 5 19:36:39 2041 UTC]

Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python312.dll.0.dr	Static PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E2983D push rdi; ret	3_2_00007FF8B7E29844
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E244F9 push rdi; ret	3_2_00007FF8B7E24502
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E29F52 push rdi; ret	3_2_00007FF8B7E29F56
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E24A15 push rdi; ret	3_2_00007FF8B7E24A1B
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8014021 push rcx; ret	3_2_00007FF8B8014022
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8CB9A93 push rbp; retn 0000h	3_2_00007FF8B8CB9A9D

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\LKEAHetlG6.exe

Process created: "C:\Users\user\Desktop\LKEAHetlG6.exe"

Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\LKEAHetlG6.exe

Code function: 0_2_00007FF7E5D64300 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF7E5D64300

Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\LKEAHetlG6.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17910

Source: C:\Users\user\Desktop\LKEAHetlG6.exe

API coverage: 1.4 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D67990 FindFirstFileExW,FindClose,	0_2_00007FF7E5D67990
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D66C30 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7E5D66C30
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D81C04 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7E5D81C04
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D67990 FindFirstFileExW,FindClose,	3_2_00007FF7E5D67990
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D66C30 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_00007FF7E5D66C30
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D81C04 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00007FF7E5D81C04
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E6EFEC FindFirstFileExW,FindClose,FindNextFileW,	3_2_00007FF8B7E6EFEC
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E42DFC FindFirstFileExW,	3_2_00007FF8B7E42DFC

Source: LKEAHetlG6.exe, 00000000.00000003.2046500637.0000023096502000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156540490.0000021EF3541000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2160226830.0000021EF3567000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158448923.0000021EF3565000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Source: C:\Users\user\Desktop\LKEAHetlG6.exe

Code function: 0_2_00007FF7E5D7A668 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7E5D7A668

Source: C:\Users\user\Desktop\LKEAHetlG6.exe

Code function: 0_2_00007FF7E5D83810 GetProcessHeap,

0_2_00007FF7E5D83810

Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D7A668 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7E5D7A668
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D6B84C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7E5D6B84C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D6AFB0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7E5D6AFB0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 0_2_00007FF7E5D6B9F0 SetUnhandledExceptionFilter,	0_2_00007FF7E5D6B9F0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D7A668 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF7E5D7A668
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D6B84C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF7E5D6B84C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D6AFB0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF7E5D6AFB0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF7E5D6B9F0 SetUnhandledExceptionFilter,	3_2_00007FF7E5D6B9F0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8A9283028 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8A9283028
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8A9282A70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8A9282A70
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E422DC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B7E422DC
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7E6CC28 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B7E6CC28
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B7FF2126 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B7FF2126
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8B33E60 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B8B33E60
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8B338A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B8B338A0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8CB9FF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B8CB9FF0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8CBAA1C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B8CBAA1C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8CE3D20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B8CE3D20
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8CE42E8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B8CE42E8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8F726A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B8F726A0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B8F730CC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B8F730CC
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B9061A00 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B9061A00
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B9061430 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B9061430
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B93C4060 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B93C4060
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B93C4620 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B93C4620
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B9841AA0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B9841AA0
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: 3_2_00007FF8B98414E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B98414E0

Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Process created: C:\Users\user\Desktop\LKEAHetlG6.exe "C:\Users\user\Desktop\LKEAHetlG6.exe"			Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "kdmapper.exe drv.sys"			Jump to behavior

Source: C:\Users\user\Desktop\LKEAHetlG6.exe

Code function: 0_2_00007FF7E5D89900 cpuid

0_2_00007FF7E5D89900

Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00007FF8B7E6B62C
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_00007FF8B7E6B4B8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: GetPrimaryLen,EnumSystemLocalesW,	3_2_00007FF8B7E6B074
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: EnterCriticalSection,EnumSystemLocalesW,LeaveCriticalSection,	3_2_00007FF8B7E68FB8
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: GetPrimaryLen,EnumSystemLocalesW,	3_2_00007FF8B7E6AFC4
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: EnumSystemLocalesW,	3_2_00007FF8B7E6AF64
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Code function: GetProcAddress,GetLocaleInfoW,	3_2_00007FF8B7E03AE0

Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\ucrtbase.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\charset_normalizer\md.cp312-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\charset_normalizer\md__mypyc.cp312-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LKEAHetlG6.exe	Queries volume information: C:\Users\user\Desktop\LKEAHetlG6.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\LKEAHetlG6.exe

Code function: 0_2_00007FF7E5D6B730 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7E5D6B730

Source: C:\Users\user\Desktop\LKEAHetlG6.exe

Code function: 0_2_00007FF7E5D85F90 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF7E5D85F90

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Process Injection	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	32 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LKEAHetlG6.exe	8%	ReversingLabs	Win64.Malware.Generic
LKEAHetlG6.exe	13%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI63402\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\charset_normalizer\md.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63402\python312.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
f005.backblazeb2.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.firmaprofesional.com/cps0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
https://tools.ietf.org/html/rfc2388#section-4.4	0%	URL Reputation	safe
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	0%	URL Reputation	safe
http://www.quovadisglobal.com/cps0	0%	URL Reputation	safe
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	0%	URL Reputation	safe
http://curl.haxx.se/rfc/cookie_spec.html	0%	URL Reputation	safe
http://repository.swisssign.com/	0%	URL Reputation	safe
http://www.accv.es/legislacion_c.htm0U	0%	URL Reputation	safe
https://wwww.certigna.fr/autorites/0m	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
https://www.python.org/	0%	URL Reputation	safe
https://json.org	0%	URL Reputation	safe
https://httpbin.org/	0%	URL Reputation	safe
https://twitter.com/	0%	URL Reputation	safe
http://www.quovadisglobal.com/cps	0%	URL Reputation	safe
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl	0%	URL Reputation	safe
http://wwwsearch.sf.net/):	0%	URL Reputation	safe
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	0%	URL Reputation	safe
http://tools.ietf.org/html/rfc6125#section-6.4.3	0%	URL Reputation	safe
https://www.openssl.org/H	0%	URL Reputation	safe
http://crl.certigna.fr/certignarootca.crl01	0%	URL Reputation	safe
https://mahler:8092/site-updates.py	0%	Avira URL Cloud	safe
http://google.com/	0%	Avira URL Cloud	safe
http://ocsp.accv.esy	0%	Avira URL Cloud	safe
http://www.accv.es00	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl	0%	Avira URL Cloud	safe
http://.../back.jpeg	0%	Avira URL Cloud	safe
https://tools.ietf.org/html/rfc7231#section-4.3.6)	0%	Avira URL Cloud	safe
https://httpbin.org/post	0%	Avira URL Cloud	safe
http://crl.securetrust.com/SGCA.crl	0%	Virustotal		Browse
http://crl.securetrust.com/SGCA.crl&	0%	Avira URL Cloud	safe
http://google.com/	1%	Virustotal		Browse
https://github.com/Ousret/charset_normalizer	0%	Avira URL Cloud	safe
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	0%	Avira URL Cloud	safe
https://tools.ietf.org/html/rfc7231#section-4.3.6)	0%	Virustotal		Browse
http://crl.securetrust.com/SGCA.crl&	0%	Virustotal		Browse
https://httpbin.org/post	1%	Virustotal		Browse
https://github.com/urllib3/urllib3/issues/2920	0%	Avira URL Cloud	safe
https://f005.backblazeb2.com/file/exefiles-storage/1/drv.sys__	0%	Avira URL Cloud	safe
https://yahoo.com/	0%	Avira URL Cloud	safe
https://github.com/Ousret/charset_normalizer	0%	Virustotal		Browse
https://github.com/urllib3/urllib3/issues/2920	0%	Virustotal		Browse
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	0%	Avira URL Cloud	safe
https://html.spec.whatwg.org/multipage/	0%	Avira URL Cloud	safe
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	0%	Avira URL Cloud	safe
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	0%	Virustotal		Browse
https://f005.backblazeb2.com/file/exefiles-storage/1/drv.sys__	1%	Virustotal		Browse
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	0%	Avira URL Cloud	safe
https://yahoo.com/	0%	Virustotal		Browse
https://html.spec.whatwg.org/multipage/	0%	Virustotal		Browse
https://f005.backblazeb2.com/file/exefiles-storage/1/drv.syspydd	0%	Avira URL Cloud	safe
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	0%	Virustotal		Browse
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	0%	Avira URL Cloud	safe
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	0%	Virustotal		Browse
https://peps.python.org/pep-0205/	0%	Avira URL Cloud	safe
https://requests.readthedocs.io	0%	Avira URL Cloud	safe
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	0%	Virustotal		Browse
http://crl.dhimyotis.com/certignarootca.crl	0%	Avira URL Cloud	safe
http://ocsp.accv.es	0%	Avira URL Cloud	safe
https://requests.readthedocs.io	0%	Virustotal		Browse
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	0%	Virustotal		Browse
http://www.cert.fnmt.es/dpcs/w	0%	Avira URL Cloud	safe
https://f005.backblazeb2.com/file/exefiles-storage/2/kdmapper.exe	0%	Avira URL Cloud	safe
http://crl.dhimyotis.com/certignarootca.crl	0%	Virustotal		Browse
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	0%	Virustotal		Browse
http://ocsp.accv.es	0%	Virustotal		Browse
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	0%	Virustotal		Browse
https://peps.python.org/pep-0205/	0%	Virustotal		Browse
http://www.cert.fnmt.es/dpcs/w	0%	Virustotal		Browse
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	0%	Avira URL Cloud	safe
http://crl.xrampsecurity.com/XGCA.crl	0%	Avira URL Cloud	safe
https://httpbin.org/get	0%	Avira URL Cloud	safe
https://f005.backblazeb2.com/file/exefiles-storage/2/kdmapper.exetionsP	0%	Avira URL Cloud	safe
https://www.python.org	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	0%	Virustotal		Browse
https://wwww.certigna.fr/autorites/4%e	0%	Avira URL Cloud	safe
https://f005.backblazeb2.com/file/exefiles-storage/2/kdmapper.exeP	0%	Avira URL Cloud	safe
http://ocsp.di	0%	Avira URL Cloud	safe
http://crl.xrampsecurity.com/XGCA.crl	0%	Virustotal		Browse
https://www.python.org	0%	Virustotal		Browse
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	0%	Avira URL Cloud	safe
https://httpbin.org/get	1%	Virustotal		Browse
https://github.com/python/cpython/issues/86361.	0%	Avira URL Cloud	safe
https://wwww.certigna.fr/autorites/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	0%	Virustotal		Browse
https://docs.python.org/3/howto/mro.html.	0%	Avira URL Cloud	safe
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	0%	Avira URL Cloud	safe
http://repository.swisssign.com/z	0%	Avira URL Cloud	safe
https://google.com/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/issues/86361.	0%	Virustotal		Browse
https://wwww.certigna.fr/autorites/	0%	Virustotal		Browse
https://google.com/mail/	0%	Avira URL Cloud	safe
https://f005.backblazeb2.com/file/exefiles-storage/2/kdmapper.exe	1%	Virustotal		Browse
https://www.python.org/psf/license/	0%	Avira URL Cloud	safe
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
f005.backblazeb2.com	149.137.136.16	true	false	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://google.com/	LKEAHetlG6.exe, 00000003.00000003.2152061445.0000021EF35C6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154817772.0000021EF35D2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156622175.0000021EF35D3000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mahler:8092/site-updates.py	LKEAHetlG6.exe, 00000003.00000002.2162862367.0000021EF387C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3E81000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157235980.0000021EF3871000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157488779.0000021EF3878000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068986087.0000021EF3F6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.accv.esy	LKEAHetlG6.exe, 00000003.00000003.2154441116.0000021EF3EAE000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157589293.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153283109.0000021EF3EAD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165252524.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152168709.0000021EF3EA5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155878335.0000021EF3EAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/SGCA.crl	LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://.../back.jpeg	LKEAHetlG6.exe, 00000003.00000002.2163729882.0000021EF3D70000.00000004.00001000.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2089157925.0000021EF3FE5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070891070.0000021EF3FE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/rfc7231#section-4.3.6)	LKEAHetlG6.exe, 00000003.00000003.2066346334.0000021EF35D6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2066626111.0000021EF35D6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152061445.0000021EF35E5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153076909.0000021EF35E6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://httpbin.org/post	LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162494798.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154296731.0000021EF3584000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2160226830.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158235787.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158994936.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155102834.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.securetrust.com/SGCA.crl&	LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Ousret/charset_normalizer	LKEAHetlG6.exe, 00000003.00000003.2152436559.0000021EF3F02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165388705.0000021EF3F1C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068671868.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158125827.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153417535.0000021EF3F17000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157755598.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152029123.0000021EF3EF0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156569932.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152550892.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068756810.0000021EF3F17000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068564281.0000021EF3F11000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.firmaprofesional.com/cps0	LKEAHetlG6.exe, 00000003.00000003.2151860384.0000021EF3F9D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2090100081.0000021EF3F9D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155306056.0000021EF40C8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152714757.0000021EF3F9D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165563791.0000021EF40C8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156401092.0000021EF3FA2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	LKEAHetlG6.exe, 00000003.00000003.2157927673.0000021EF1ACD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2062877388.0000021EF1A7E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158623728.0000021EF3545000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158514491.0000021EF1ACF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2061950412.0000021EF355B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156540490.0000021EF3541000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158659929.0000021EF354F000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2063791387.0000021EF355B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152607937.0000021EF1AB2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152242908.0000021EF1AAF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162471442.0000021EF355C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158888967.0000021EF1AD0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152136896.0000021EF1AA3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2920	LKEAHetlG6.exe, 00000003.00000002.2165839985.0000021EF427C000.00000004.00001000.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://f005.backblazeb2.com/file/exefiles-storage/1/drv.sys__	LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4410000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.securetrust.com/SGCA.crl0	LKEAHetlG6.exe, 00000003.00000003.2156370154.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://yahoo.com/	LKEAHetlG6.exe, 00000003.00000003.2152436559.0000021EF3F02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2089470414.0000021EF39A5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157170637.0000021EF3F08000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156456390.0000021EF39BB000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068671868.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158125827.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153417535.0000021EF3F17000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157755598.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2151634462.0000021EF39A7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152029123.0000021EF3EF0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154926282.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156569932.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152550892.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068756810.0000021EF3F17000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153045508.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068564281.0000021EF3F11000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.securetrust.com/STCA.crl0	LKEAHetlG6.exe, 00000003.00000003.2156370154.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://tools.ietf.org/html/rfc2388#section-4.4	LKEAHetlG6.exe, 00000003.00000003.2157278979.0000021EF38E9000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068489279.0000021EF3880000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154646537.0000021EF38E8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152384924.0000021EF38E7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152311361.0000021EF38D8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	LKEAHetlG6.exe, 00000003.00000003.2089470414.0000021EF39A5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2066182430.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2151634462.0000021EF39A7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152949314.0000021EF39C1000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068235580.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	LKEAHetlG6.exe, 00000003.00000003.2153488736.0000021EF3A02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2089883248.0000021EF39F3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF39F3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2151634462.0000021EF39F3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152949314.0000021EF39F3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068235580.0000021EF39F3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068235580.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://html.spec.whatwg.org/multipage/	LKEAHetlG6.exe, 00000003.00000003.2152489145.0000021EF3915000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2163084099.0000021EF3924000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2160759120.0000021EF3924000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2090075701.0000021EF390F000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068235580.0000021EF390E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152384924.0000021EF38E7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152311361.0000021EF38D8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153402815.0000021EF3923000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152534781.0000021EF391D000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF3907000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.quovadisglobal.com/cps0	LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155306056.0000021EF40C8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165563791.0000021EF40C8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	LKEAHetlG6.exe, 00000003.00000003.2155067013.0000021EF40DF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155425564.0000021EF40E3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	LKEAHetlG6.exe, 00000003.00000002.2163729882.0000021EF3D70000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://f005.backblazeb2.com/file/exefiles-storage/1/drv.syspydd	LKEAHetlG6.exe, 00000003.00000002.2162261698.0000021EF3350000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	LKEAHetlG6.exe, 00000003.00000003.2068489279.0000021EF3880000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154646537.0000021EF38E8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152384924.0000021EF38E7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157294454.0000021EF38FF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152311361.0000021EF38D8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157217178.0000021EF38EF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3ED2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069500003.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2163655584.0000021EF3C70000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://requests.readthedocs.io	LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162494798.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154296731.0000021EF3584000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2160226830.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4410000.00000004.00001000.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158235787.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158994936.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155102834.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0205/	LKEAHetlG6.exe, 00000003.00000002.2162751342.0000021EF3770000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.dhimyotis.com/certignarootca.crl	LKEAHetlG6.exe, 00000003.00000003.2155930267.0000021EF411B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154248967.0000021EF4108000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157235980.0000021EF3871000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155425564.0000021EF410C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://curl.haxx.se/rfc/cookie_spec.html	LKEAHetlG6.exe, 00000003.00000003.2152436559.0000021EF3F02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157170637.0000021EF3F08000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165368085.0000021EF3F10000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070084203.0000021EF3F3C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070891070.0000021EF3F3E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152029123.0000021EF3EF0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3F3C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154926282.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153045508.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165839985.0000021EF427C000.00000004.00001000.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.accv.es	LKEAHetlG6.exe, 00000003.00000003.2154441116.0000021EF3EAE000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157589293.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153283109.0000021EF3EAD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165252524.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152168709.0000021EF3EA5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155878335.0000021EF3EAF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://repository.swisssign.com/	LKEAHetlG6.exe, 00000003.00000003.2161365714.0000021EF40B6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156995241.0000021EF40A9000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154646537.0000021EF38E8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157627855.0000021EF3907000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165541332.0000021EF40C1000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161345104.0000021EF40AC000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152384924.0000021EF38E7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157294454.0000021EF38FF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152311361.0000021EF38D8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161467423.0000021EF40BC000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157217178.0000021EF38EF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161384766.0000021EF40BB000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.cert.fnmt.es/dpcs/w	LKEAHetlG6.exe, 00000003.00000003.2157771510.0000021EF3E81000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156370154.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://f005.backblazeb2.com/file/exefiles-storage/2/kdmapper.exe	LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4410000.00000004.00001000.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162261698.0000021EF33D0000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	LKEAHetlG6.exe, 00000003.00000002.2163729882.0000021EF3D70000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	LKEAHetlG6.exe, 00000003.00000002.2162261698.0000021EF3350000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://httpbin.org/get	LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4370000.00000004.00001000.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl	LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://f005.backblazeb2.com/file/exefiles-storage/2/kdmapper.exetionsP	LKEAHetlG6.exe, 00000003.00000002.2162261698.0000021EF33D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org	LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162494798.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154296731.0000021EF3584000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2160226830.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158235787.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158994936.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155102834.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://wwww.certigna.fr/autorites/4%e	LKEAHetlG6.exe, 00000003.00000003.2155945272.0000021EF4135000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154248967.0000021EF4108000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155150281.0000021EF411E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155288495.0000021EF4131000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.accv.es/legislacion_c.htm0U	LKEAHetlG6.exe, 00000003.00000003.2155067013.0000021EF40DF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155560449.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165602889.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155088852.0000021EF4103000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://f005.backblazeb2.com/file/exefiles-storage/2/kdmapper.exeP	LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4410000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wwww.certigna.fr/autorites/0m	LKEAHetlG6.exe, 00000003.00000003.2157235980.0000021EF3871000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.accv.es0	LKEAHetlG6.exe, 00000003.00000003.2155067013.0000021EF40DF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155560449.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165602889.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155088852.0000021EF4103000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.di	LKEAHetlG6.exe, 00000000.00000003.2040579112.0000023096500000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/	LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3E81000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157235980.0000021EF3871000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068986087.0000021EF3F6A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	LKEAHetlG6.exe, 00000003.00000003.2157927673.0000021EF1ACD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2062877388.0000021EF1A7E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158623728.0000021EF3545000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158514491.0000021EF1ACF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2061950412.0000021EF355B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156540490.0000021EF3541000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158659929.0000021EF354F000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2063791387.0000021EF355B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2159150958.0000021EF1AD1000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162199260.0000021EF1AD1000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152607937.0000021EF1AB2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152242908.0000021EF1AAF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162471442.0000021EF355C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158888967.0000021EF1AD0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152136896.0000021EF1AA3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/python/cpython/issues/86361.	LKEAHetlG6.exe, 00000003.00000003.2065201080.0000021EF399C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068489279.0000021EF3880000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2066701059.0000021EF3880000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2066391193.0000021EF3880000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2065341640.0000021EF359E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152384924.0000021EF38E7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152311361.0000021EF38D8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://json.org	LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF3907000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071262885.0000021EF3A11000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068235580.0000021EF3A11000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158094967.0000021EF3A19000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://httpbin.org/	LKEAHetlG6.exe, 00000003.00000003.2156602962.0000021EF358C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://wwww.certigna.fr/autorites/	LKEAHetlG6.exe, 00000003.00000003.2155945272.0000021EF4135000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154248967.0000021EF4108000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155150281.0000021EF411E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155288495.0000021EF4131000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://docs.python.org/3/howto/mro.html.	LKEAHetlG6.exe, 00000003.00000003.2061790031.0000021EF35BE000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2063791387.0000021EF3550000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162261698.0000021EF33D0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/	LKEAHetlG6.exe, 00000003.00000003.2152436559.0000021EF3F02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068671868.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152029123.0000021EF3EF0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154296731.0000021EF3584000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152550892.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156569932.0000021EF3F16000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068564281.0000021EF3F11000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155102834.0000021EF3587000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156602962.0000021EF358C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.quovadisglobal.com/cps	LKEAHetlG6.exe, 00000003.00000003.2161365714.0000021EF40B6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156995241.0000021EF40A9000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161345104.0000021EF40AC000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161467423.0000021EF40BC000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161384766.0000021EF40BB000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	LKEAHetlG6.exe, 00000003.00000003.2153309139.0000021EF359B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2089470414.0000021EF39A5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2163322872.0000021EF39E7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154668634.0000021EF39D1000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2160404641.0000021EF39E3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2151634462.0000021EF39A7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152949314.0000021EF39C1000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161678266.0000021EF39E6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154612082.0000021EF39CF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153521804.0000021EF39CE000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155705158.0000021EF39D4000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068235580.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	LKEAHetlG6.exe, 00000003.00000003.2157927673.0000021EF1ACD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2062877388.0000021EF1A7E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152266869.0000021EF3535000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158623728.0000021EF3545000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158514491.0000021EF1ACF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2061950412.0000021EF355B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156540490.0000021EF3541000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158659929.0000021EF354F000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2063791387.0000021EF355B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152607937.0000021EF1AB2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152242908.0000021EF1AAF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2162471442.0000021EF355C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158888967.0000021EF1AD0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152136896.0000021EF1AA3000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://repository.swisssign.com/z	LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google.com/	LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154891725.0000021EF39A7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068235580.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156602962.0000021EF358C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google.com/mail/	LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/psf/license/	LKEAHetlG6.exe, 00000003.00000002.2168429309.00007FF8A8DF8000.00000008.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://google.com/mail/	LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3ED2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069500003.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153503679.0000021EF3ED6000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153283109.0000021EF3EAD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153995890.0000021EF3EEE000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152168709.0000021EF3EA5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/STCA.crl	LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://wwwsearch.sf.net/):	LKEAHetlG6.exe, 00000003.00000003.2154441116.0000021EF3EAE000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069500003.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157589293.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070084203.0000021EF3F3C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070891070.0000021EF3F3E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153283109.0000021EF3EAD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165252524.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3F3C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152168709.0000021EF3EA5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155878335.0000021EF3EAF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	LKEAHetlG6.exe, 00000003.00000003.2155067013.0000021EF40DF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154441116.0000021EF3EAE000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155560449.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165602889.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157589293.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153283109.0000021EF3EAD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165252524.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152168709.0000021EF3EA5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155878335.0000021EF3EAF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155088852.0000021EF4103000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.accv.es/legislacion_c.htm	LKEAHetlG6.exe, 00000003.00000003.2155067013.0000021EF40DF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155199818.0000021EF40EC000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tools.ietf.org/html/rfc6125#section-6.4.3	LKEAHetlG6.exe, 00000003.00000002.2163729882.0000021EF3D70000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl0	LKEAHetlG6.exe, 00000003.00000003.2152436559.0000021EF3F02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157170637.0000021EF3F08000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152029123.0000021EF3EF0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154926282.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153045508.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.openssl.org/H	LKEAHetlG6.exe, 00000000.00000003.2048866114.0000023096504000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmp, LKEAHetlG6.exe, 00000003.00000002.2167716527.00007FF8A887A000.00000002.00000001.01000000.0000000A.sdmp, libcrypto-3.dll.0.dr, libssl-3.dll.0.dr	false	URL Reputation: safe	unknown
http://crl.certigna.fr/certignarootca.crl01	LKEAHetlG6.exe, 00000003.00000003.2155930267.0000021EF411B000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154248967.0000021EF4108000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157235980.0000021EF3871000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155425564.0000021EF410C000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.cert.fnmt.es/dpcs/	LKEAHetlG6.exe, 00000003.00000003.2157771510.0000021EF3E81000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154248967.0000021EF4108000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156208856.0000021EF4132000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161212232.0000021EF4132000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155150281.0000021EF411E000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155288495.0000021EF4131000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156370154.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google.com/mail	LKEAHetlG6.exe, 00000003.00000003.2152436559.0000021EF3F02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2089470414.0000021EF39A5000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157170637.0000021EF3F08000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156456390.0000021EF39BB000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068671868.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2158125827.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153417535.0000021EF3F17000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2157755598.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2151634462.0000021EF39A7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152029123.0000021EF3EF0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154926282.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2156569932.0000021EF3F18000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069235984.0000021EF39BA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152550892.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068756810.0000021EF3F17000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153045508.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068564281.0000021EF3F11000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://f005.backblazeb2.com/file/exefiles-storage/1/drv.sys	LKEAHetlG6.exe, 00000003.00000002.2162261698.0000021EF3350000.00000004.00001000.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4410000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.accv.es00	LKEAHetlG6.exe, 00000003.00000003.2155067013.0000021EF40DF000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155560449.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154726166.0000021EF40A8000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165602889.0000021EF4107000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155199818.0000021EF40EC000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2088940268.0000021EF4102000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154759537.0000021EF40C7000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2155088852.0000021EF4103000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154993870.0000021EF40CA000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153598712.0000021EF40A2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.python.org/psf/license/)	LKEAHetlG6.exe, 00000003.00000002.2167979262.00007FF8A8C81000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	LKEAHetlG6.exe, 00000003.00000003.2153324572.0000021EF353B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy	LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4410000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0263/	LKEAHetlG6.exe, 00000003.00000002.2167979262.00007FF8A8C81000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://foss.heptapod.net/pypy/pypy/-/issues/3539	LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3ED2000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069500003.0000021EF3EB0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2163655584.0000021EF3C70000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	LKEAHetlG6.exe, 00000003.00000003.2152436559.0000021EF3F02000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2069039955.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2067978758.0000021EF3EFD000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068671868.0000021EF3F15000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2152029123.0000021EF3EF0000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2161546329.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2154926282.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000002.2165347108.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068756810.0000021EF3F17000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2153045508.0000021EF3F03000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2071379859.0000021EF3E71000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2068564281.0000021EF3F11000.00000004.00000020.00020000.00000000.sdmp, LKEAHetlG6.exe, 00000003.00000003.2070374501.0000021EF3EA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/psf/requests/pull/6710	LKEAHetlG6.exe, 00000003.00000002.2165980728.0000021EF4370000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.137.136.16	f005.backblazeb2.com	United States		30103	ZOOM-VIDEO-COMM-ASUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1487187
Start date and time:	2024-08-03 09:56:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LKEAHetlG6.exe renamed because original name is a hash value
Original Sample Name:	c4f3815a85c4c42379e5a5fadeddfd6a5c412ab48b628ad6d07d85eb5827a009.exe
Detection:	MAL
Classification:	mal52.winEXE@6/56@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.137.136.16	zCYHTVvEqm.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse
	http://www.ln.run/BSrHQ/	Get hash	malicious	Unknown	Browse
	https://f005.backblazeb2.com/file/roboties48/index.html	Get hash	malicious	Unknown	Browse
	https://na4.docusign.net/Signing/EmailStart.aspx?a=ba2f41e9-baaf-4cfa-bac9-97afaa73a1c7&acct=97628bf5-2dcc-4379-8c8b-719995aa39f7&er=432aa911-ffaa-47c2-9cba-5584ad4ba6ec	Get hash	malicious	HTMLPhisher	Browse
	https://f005.backblazeb2.com/file/yahoos66/glogin.html	Get hash	malicious	Unknown	Browse
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=tg1j7YnlEUCGCEN8r-hdbL2y774DAIJEjU_nCKb9wOlUNUlFWjRMS0ZCNloyVTM4R0U3T0c1TjBCVi4u	Get hash	malicious	HTMLPhisher	Browse
	https://ecv.microsoft.com/BcEEKIqBNU	Get hash	malicious	HTMLPhisher	Browse
	https://sites.google.com/view/drypapersonalbankruptcy/home	Get hash	malicious	HTMLPhisher	Browse
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=_HkV8W7DpUuifstDSryGNxqrvyMyb5JNtRYXwlOy-ZhUMkZaWk1ISTRDNlcyVlYyQ0JTWjdRR0Q1RS4u	Get hash	malicious	HTMLPhisher	Browse
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=YDCDde770Ueh5dtv6QWp2ez1wu3978xAu7QoNXSq2MBUQVo4VVFVR0ExUkpKWUJKVk1FUzdBWkg2VS4u	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
f005.backblazeb2.com	zCYHTVvEqm.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	149.137.136.16
	http://www.ln.run/BSrHQ/	Get hash	malicious	Unknown	Browse	149.137.136.16
	https://f005.backblazeb2.com/file/roboties48/index.html	Get hash	malicious	Unknown	Browse	149.137.136.16
	https://na4.docusign.net/Signing/EmailStart.aspx?a=ba2f41e9-baaf-4cfa-bac9-97afaa73a1c7&acct=97628bf5-2dcc-4379-8c8b-719995aa39f7&er=432aa911-ffaa-47c2-9cba-5584ad4ba6ec	Get hash	malicious	HTMLPhisher	Browse	149.137.136.16
	https://f005.backblazeb2.com/file/yahoos66/glogin.html	Get hash	malicious	Unknown	Browse	149.137.136.16
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=tg1j7YnlEUCGCEN8r-hdbL2y774DAIJEjU_nCKb9wOlUNUlFWjRMS0ZCNloyVTM4R0U3T0c1TjBCVi4u	Get hash	malicious	HTMLPhisher	Browse	149.137.136.16
	https://ecv.microsoft.com/BcEEKIqBNU	Get hash	malicious	HTMLPhisher	Browse	149.137.136.16
	https://sites.google.com/view/drypapersonalbankruptcy/home	Get hash	malicious	HTMLPhisher	Browse	149.137.136.16
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=YDCDde770Ueh5dtv6QWp2ez1wu3978xAu7QoNXSq2MBUQVo4VVFVR0ExUkpKWUJKVk1FUzdBWkg2VS4u	Get hash	malicious	HTMLPhisher	Browse	149.137.136.16
	https://f005.backblazeb2.com/b2api/v1/b2_download_file_by_id?fileid=4_z4bed65aed9dccfff819c0814_f1197bbd660a9cbda_d20230807_m115920_c005_v0521006_t0054_u01691409560201	Get hash	malicious	Unknown	Browse	149.137.136.16

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ZOOM-VIDEO-COMM-ASUS	zCYHTVvEqm.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	149.137.136.16
	hgt1WRKzKt.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	149.137.137.254
	yZT4VDN0sk.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	149.137.137.254
	https://docs.google.com/drawings/d/1e_ozWSFq93ETp5eAzec4s3erAU8PzdP48pyt4fxNtl4/preview?pli=1	Get hash	malicious	HTMLPhisher	Browse	149.137.137.254
	http://www.ln.run/BSrHQ/	Get hash	malicious	Unknown	Browse	149.137.136.16
	https://f005.backblazeb2.com/file/roboties48/index.html	Get hash	malicious	Unknown	Browse	149.137.136.16
	https://1drv.ms/o/s!ArBtBaxzZQ2-bgubRKeHU2HcLQk?e=2pF7dh	Get hash	malicious	HTMLPhisher	Browse	149.137.129.254
	https://docs.google.com/drawings/u/0/d/1Lm_lPFW1hN0tIjBZtfH2sq0Q6UPjdfB1utEgL942uZg/preview?pli=1	Get hash	malicious	HTMLPhisher	Browse	149.137.137.254
	http://pub-9f23a057c92846ceb9a489bd3cb57fd5.r2.dev/index.htm?y=d:%25jx@bli4f1ud%7Cbibgos??u	Get hash	malicious	Unknown	Browse	149.137.137.254
	https://jffjdi1911.s3.us-west-002.backblazeb2.com/Attachments.html	Get hash	malicious	Unknown	Browse	149.137.142.254

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI63402\VCRUNTIME140.dll	Base.exe	Get hash	malicious	AsyncRAT, Blank Grabber, XWorm	Browse
	Doc4.docx.doc	Get hash	malicious	Unknown	Browse
	1 (3).exe	Get hash	malicious	Unknown	Browse
	Doc4.docx.doc	Get hash	malicious	Unknown	Browse
	Windows.exe	Get hash	malicious	Python Stealer	Browse
	V3NOM LOGGER 1.05.exe	Get hash	malicious	XWorm	Browse
	setup.exe	Get hash	malicious	XWorm	Browse
	CrowdStrike Falcon.exe	Get hash	malicious	Python Stealer	Browse
	kITyVxWkHB.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, PureLog Stealer, RedLine	Browse
	SPt4FUjZMt.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, PythonCryptoHijacker, RedLine	Browse
C:\Users\user\AppData\Local\Temp\_MEI63402\_bz2.pyd	Doc4.docx.doc	Get hash	malicious	Unknown	Browse
	1 (3).exe	Get hash	malicious	Unknown	Browse
	Doc4.docx.doc	Get hash	malicious	Unknown	Browse
	V3NOM LOGGER 1.05.exe	Get hash	malicious	XWorm	Browse
	setup.exe	Get hash	malicious	XWorm	Browse
	kITyVxWkHB.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, PureLog Stealer, RedLine	Browse
	SPt4FUjZMt.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, PythonCryptoHijacker, RedLine	Browse
	WfKynArKjH.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, RedLine	Browse
	8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b.exe	Get hash	malicious	Unknown	Browse
	8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI63402\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Base.exe, Detection: malicious, Browse Filename: Doc4.docx.doc, Detection: malicious, Browse Filename: 1 (3).exe, Detection: malicious, Browse Filename: Doc4.docx.doc, Detection: malicious, Browse Filename: Windows.exe, Detection: malicious, Browse Filename: V3NOM LOGGER 1.05.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: CrowdStrike Falcon.exe, Detection: malicious, Browse Filename: kITyVxWkHB.exe, Detection: malicious, Browse Filename: SPt4FUjZMt.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85272
Entropy (8bit):	6.593462846910602
Encrypted:	false
SSDEEP:	1536:i2sz7yc51BVo1QX/FPI11IK1cDm015ssO687sjkD1ISCV087Syyxt+:dsz2c5eQXB4am05spd7MkD1ISCVzL
MD5:	5BEBC32957922FE20E927D5C4637F100
SHA1:	A94EA93EE3C3D154F4F90B5C2FE072CC273376B3
SHA-256:	3ED0E5058D370FB14AA5469D81F96C5685559C054917C7280DD4125F21D25F62
SHA-512:	AFBE80A73EE9BD63D9FFA4628273019400A75F75454667440F43BEB253091584BF9128CBB78AE7B659CE67A5FAEFDBA726EDB37987A4FE92F082D009D523D5D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Doc4.docx.doc, Detection: malicious, Browse Filename: 1 (3).exe, Detection: malicious, Browse Filename: Doc4.docx.doc, Detection: malicious, Browse Filename: V3NOM LOGGER 1.05.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: kITyVxWkHB.exe, Detection: malicious, Browse Filename: SPt4FUjZMt.exe, Detection: malicious, Browse Filename: WfKynArKjH.exe, Detection: malicious, Browse Filename: 8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b.exe, Detection: malicious, Browse Filename: 8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................b......................................................................................Rich...................PE..d.....bf.........." ...(.....^...............................................`......P.....`.........................................p...H............@.......0..D......../...P..........T...........................p...@............................................text.../........................... ..`.rdata..P>.......@..................@..@.data........ ......................@....pdata..D....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	257304
Entropy (8bit):	6.565489271518002
Encrypted:	false
SSDEEP:	6144:vnXBJvhy8AJOMg4hmRWw710z4ez9qWM53pLW1AW/ZJJJWtCk1mGc:ByJJOMiRW+10EHFpNc
MD5:	492C0C36D8ED1B6CA2117869A09214DA
SHA1:	B741CAE3E2C9954E726890292FA35034509EF0F6
SHA-256:	B8221D1C9E2C892DD6227A6042D1E49200CD5CB82ADBD998E4A77F4EE0E9ABF1
SHA-512:	B8F1C64AD94DB0252D96082E73A8632412D1D73FB8095541EE423DF6F00BC417A2B42C76F15D7E014E27BAAE0EF50311C3F768B1560DB005A522373F442E4BE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V.............. .....G&......G&......G&......G&.......!......................!.......!.......!.......!L......!......Rich............PE..d.....bf.........." ...(.....<............................................................`..........................................c..P....c...................&......./......T.......T...........................p...@............................................text...I........................... ..`.rdata..(...........................@..@.data...X*.......$...b..............@....pdata...&.......(..................@..@.rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66328
Entropy (8bit):	6.2279606895285875
Encrypted:	false
SSDEEP:	1536:JgHpgE4Z27b4ZWZnEmIAtISOIx7SyZUxN:i14ZeEmIAtISOIx7+
MD5:	DA02CEFD8151ECB83F697E3BD5280775
SHA1:	1C5D0437EB7E87842FDE55241A5F0CA7F0FC25E7
SHA-256:	FD77A5756A17EC0788989F73222B0E7334DD4494B8C8647B43FE554CF3CFB354
SHA-512:	A13BC5C481730F48808905F872D92CB8729CC52CFB4D5345153CE361E7D6586603A58B964A1EBFD77DD6222B074E5DCCA176EAAEFECC39F75496B1F8387A2283
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........N@.. ... ... ...... ..k!... ..k#... ..k$... ..k%... ..l!... ...!... ..h!... ...!.A. ..l-... ..l ... ..l.... ..l"... .Rich.. .........................PE..d.....bf.........." ...(.V.......... @...............................................G....`.........................................p...P................................/......X...@}..T............................\|..@............p..(............................text....T.......V.................. ..`.rdata...O...p...P...Z..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	160024
Entropy (8bit):	6.854257867628366
Encrypted:	false
SSDEEP:	3072:Bsvkxuqgo7e2uONqG+hi+CSznfF9mNopXnmnu1ISZ1Vk:BnuFo7Jg1NYOp2uO
MD5:	195DEFE58A7549117E06A57029079702
SHA1:	3795B02803CA37F399D8883D30C0AA38AD77B5F2
SHA-256:	7BF9FF61BABEBD90C499A8ED9B62141F947F90D87E0BBD41A12E99D20E06954A
SHA-512:	C47A9B1066DD9744C51ED80215BD9645AAB6CC9D6A3F9DF99F618E3DD784F6C7CE6F53EABE222CF134EE649250834193D5973E6E88F8A93151886537C62E2E2B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......hD..,%.X,%.X,%.X%]7X(%.X.Y.%.X.Y/%.X.Y$%.X.Y %.X?..Y/%.Xg].Y.%.X,%.XI%.X?..Y.%.X?..Y-%.X?.[X-%.X?..Y-%.XRich,%.X........PE..d.....bf.........." ...(.f..........`8....................................................`......................................... %..L...l%..x....p.......P.......B.../......4.......T...............................@............................................text...be.......f.................. ..`.rdata..............j..............@..@.data...p....@......................@....pdata.......P......."..............@..@.rsrc........p.......6..............@..@.reloc..4............@..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32536
Entropy (8bit):	6.5090721419869135
Encrypted:	false
SSDEEP:	768:xOz+R6rbVKMoNpISQUA5YiSyv86lAMxkEzc:xjgbVJoNpISQUS7SyU6dxPc
MD5:	B7E5FBD7EF3EEFFF8F502290C0E2B259
SHA1:	9DECBA47B1CDB0D511B58C3146D81644E56E3611
SHA-256:	DBDABB5FE0CCBC8B951A2C6EC033551836B072CAB756AAA56B6F22730080D173
SHA-512:	B7568B9DF191347D1A8D305BD8DDD27CBFA064121C785FA2E6AFEF89EC330B60CAFC366BE2B22409D15C9434F5E46E36C5CBFB10783523FDCAC82C30360D36F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.\.V...V...V...."..V......V......V......V......V......V.......V...V...V......V......V....N..V......V..Rich.V..................PE..d.....bf.........." ...(.....8......................................................1.....`..........................................C..L....D..d....p.......`.......P.../..........p4..T...........................03..@............0..8............................text...0........................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83736
Entropy (8bit):	6.32286800032437
Encrypted:	false
SSDEEP:	1536:ldcydNgIznrvGvLfo4o7zfqwXJ9/s+S+pzo08/n1IsJhv6cpISLwV97Sy7UxV:l6ydrr+DgxjqwXJ9/sT+pzoN1IwhScpf
MD5:	DD8FF2A3946B8E77264E3F0011D27704
SHA1:	A2D84CFC4D6410B80EEA4B25E8EFC08498F78990
SHA-256:	B102522C23DAC2332511EB3502466CAF842D6BCD092FBC276B7B55E9CC01B085
SHA-512:	958224A974A3449BCFB97FAAB70C0A5B594FA130ADC0C83B4E15BDD7AAB366B58D94A4A9016CB662329EA47558645ACD0E0CC6DF54F12A81AC13A6EC0C895CD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...Nb}.Nb}.Nb}.6.}.Nb}O.c\|.Nb}O.a\|.Nb}O.f\|.Nb}O.g\|.Nb}..c\|.Nb}.Nc}4Nb}.6c\|.Nb}..o\|.Nb}..b\|.Nb}..}.Nb}..`\|.Nb}Rich.Nb}........PE..d.....bf.........." ...(.x..........`-.......................................`...........`.............................................P............@.......0.........../...P..........T...............................@............................................text....v.......x.................. ..`.rdata...x.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	178968
Entropy (8bit):	5.9687584339585324
Encrypted:	false
SSDEEP:	3072:AHtmUArl7bOGLbfbmeq2wfq6XDQJsY2GvMe1ba+VRJNI7IM/H9o/PCrXuI51ISCQ:Ym5lfOGLbjBOq6XD4MejTGl
MD5:	C87C5890039C3BDB55A8BC189256315F
SHA1:	84EF3C2678314B7F31246471B3300DA65CB7E9DE
SHA-256:	A5D361707F7A2A2D726B20770E8A6FC25D753BE30BCBCBBB683FFEE7959557C2
SHA-512:	E750DC36AE00249ED6DA1C9D816F1BD7F8BC84DDEA326C0CD0410DBCFB1A945AAC8C130665BFACDCCD1EE2B7AC097C6FF241BFC6CC39017C9D1CDE205F460C44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^..`...`...`......`..ia...`..ic...`..id...`..ie...`..na...`..ja...`...a.I.`...a...`..nm...`..n`...`..n....`..nb...`.Rich..`.........................PE..d.....bf.........." ...(............P,..............................................Bj....`.............................................d...D...................P......../......x.......T...........................@...@............................................text...0........................... ..`.rdata...#.......$..................@..@.data...p...........................@....pdata..P............d..............@..@.rsrc................p..............@..@.reloc..x............z..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22112
Entropy (8bit):	4.744270711412692
Encrypted:	false
SSDEEP:	192:zFOhcWqhWpvWEXCVWQ4iWwklRxwVIX01k9z3AROVaz4ILS:zFlWqhWpk6R9zeU0J2
MD5:	E8B9D74BFD1F6D1CC1D99B24F44DA796
SHA1:	A312CFC6A7ED7BF1B786E5B3FD842A7EEB683452
SHA-256:	B1B3FD40AB437A43C8DB4994CCFFC7F88000CC8BB6E34A2BCBFF8E2464930C59
SHA-512:	B74D9B12B69DB81A96FC5A001FD88C1E62EE8299BA435E242C5CB2CE446740ED3D8A623E1924C2BC07BFD9AEF7B2577C9EC8264E53E5BE625F4379119BAFCC27
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....dZ..........." .........0...............................................@............`A........................................p...,............0...............0..`&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.602255667966723
Encrypted:	false
SSDEEP:	192:NWqhWEWEXCVWQ4cRWvBQrVXC4dlgX01k9z3AUj7W6SxtR:NWqhWPlZVXC4deR9zVj7QR
MD5:	CFE0C1DFDE224EA5FED9BD5FF778A6E0
SHA1:	5150E7EDD1293E29D2E4D6BB68067374B8A07CE6
SHA-256:	0D0F80CBF476AF5B1C9FD3775E086ED0DFDB510CD0CC208EC1CCB04572396E3E
SHA-512:	B0E02E1F19CFA7DE3693D4D63E404BDB9D15527AC85A6D492DB1128BB695BFFD11BEC33D32F317A7615CB9A820CD14F9F8B182469D65AF2430FFCDBAD4BD7000
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....N7.........." .........0...............................................@............`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.606873381830854
Encrypted:	false
SSDEEP:	192:T0WqhWnWEXCVWQ4mW5ocADB6ZX01k9z3AkprGvV:T0WqhW8VcTR9zJpr4V
MD5:	33BBECE432F8DA57F17BF2E396EBAA58
SHA1:	890DF2DDDFDF3EECCC698312D32407F3E2EC7EB1
SHA-256:	7CF0944901F7F7E0D0B9AD62753FC2FE380461B1CCE8CDC7E9C9867C980E3B0E
SHA-512:	619B684E83546D97FC1D1BC7181AD09C083E880629726EE3AF138A9E4791A6DCF675A8DF65DC20EDBE6465B5F4EAC92A64265DF37E53A5F34F6BE93A5C2A7AE5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....IL..........." .........0...............................................@...........`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.65169290018864
Encrypted:	false
SSDEEP:	192:qzmxD3T4qLWqhW2WJWadJCsVWQ4mW/xNVAv+cQ0GX01k9z3ARoanSwT44:qzQVWqhWTCsiNbZR9zQoUSwTJ
MD5:	EB0978A9213E7F6FDD63B2967F02D999
SHA1:	9833F4134F7AC4766991C918AECE900ACFBF969F
SHA-256:	AB25A1FE836FC68BCB199F1FE565C27D26AF0C390A38DA158E0D8815EFE1103E
SHA-512:	6F268148F959693EE213DB7D3DB136B8E3AD1F80267D8CBD7D5429C021ADACCC9C14424C09D527E181B9C9B5EA41765AFF568B9630E4EB83BFC532E56DFE5B63
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..H...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26216
Entropy (8bit):	4.866487428274293
Encrypted:	false
SSDEEP:	192:gaNYPvVX8rFTsCWqhWVWEXCVWQ4mWPJlBLrp0KBQfX01k9z3ALkBw:WPvVX8WqhWiyBRxB+R9z2kBw
MD5:	EFAD0EE0136532E8E8402770A64C71F9
SHA1:	CDA3774FE9781400792D8605869F4E6B08153E55
SHA-256:	3D2C55902385381869DB850B526261DDEB4628B83E690A32B67D2E0936B2C6ED
SHA-512:	69D25EDF0F4C8AC5D77CB5815DFB53EAC7F403DC8D11BFE336A545C19A19FFDE1031FA59019507D119E4570DA0D79B95351EAC697F46024B4E558A0FF6349852
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....(............" .........@...............................................P......z.....`A........................................p................@...............@..h&..............p............................................................................rdata..\|........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.619913450163593
Encrypted:	false
SSDEEP:	192:iDGaWqhWhWJWadJCsVWQ4mWd9afKUSIX01k9z3AEXzAU9:i6aWqhWACs92IR9z5EU9
MD5:	1C58526D681EFE507DEB8F1935C75487
SHA1:	0E6D328FAF3563F2AAE029BC5F2272FB7A742672
SHA-256:	EF13DCE8F71173315DFC64AB839B033AB19A968EE15230E9D4D2C9D558EFEEE2
SHA-512:	8EDB9A0022F417648E2ECE9E22C96E2727976332025C3E7D8F15BCF6D7D97E680D1BF008EB28E2E0BD57787DCBB71D38B2DEB995B8EDC35FA6852AB1D593F3D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....RS.........." .........0...............................................@......;.....`A........................................p...L............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18696
Entropy (8bit):	7.054510010549814
Encrypted:	false
SSDEEP:	384:eVrW1hWbvm0GftpBjzH4m3S9gTlUK3dsl:eVuAViaB/6sl
MD5:	BFFFA7117FD9B1622C66D949BAC3F1D7
SHA1:	402B7B8F8DCFD321B1D12FC85A1EE5137A5569B2
SHA-256:	1EA267A2E6284F17DD548C6F2285E19F7EDB15D6E737A55391140CE5CB95225E
SHA-512:	B319CC7B436B1BE165CDF6FFCAB8A87FE29DE78F7E0B14C8F562BE160481FB5483289BD5956FDC1D8660DA7A3F86D8EEDE35C6CC2B7C3D4C852DECF4B2DCDB7F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...4.F>.........." .........................................................0............`.........................................`................ ...................=..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.625331165566263
Encrypted:	false
SSDEEP:	192:qzWqhWxWJWadJCsVWQ4mW8RJLNVAv+cQ0GX01k9z3ARo8ef3uBJu:qzWqhWwCsjNbZR9zQoEzu
MD5:	E89CDCD4D95CDA04E4ABBA8193A5B492
SHA1:	5C0AEE81F32D7F9EC9F0650239EE58880C9B0337
SHA-256:	1A489E0606484BD71A0D9CB37A1DC6CA8437777B3D67BFC8C0075D0CC59E6238
SHA-512:	55D01E68C8C899E99A3C62C2C36D6BCB1A66FF6ECD2636D2D0157409A1F53A84CE5D6F0C703D5ED47F8E9E2D1C9D2D87CC52585EE624A23D92183062C999B97E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....Hb..........." .........0...............................................@............`A........................................p...`............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.737397647066978
Encrypted:	false
SSDEEP:	192:OdxlZWqhWcWJWadJCsVWQ4mWlhtFyttuX01k9z3A2oD:OdxlZWqhWpCsctkSR9zfoD
MD5:	ACCC640D1B06FB8552FE02F823126FF5
SHA1:	82CCC763D62660BFA8B8A09E566120D469F6AB67
SHA-256:	332BA469AE84AA72EC8CCE2B33781DB1AB81A42ECE5863F7A3CB5A990059594F
SHA-512:	6382302FB7158FC9F2BE790811E5C459C5C441F8CAEE63DF1E09B203B8077A27E023C4C01957B252AC8AC288F8310BCEE5B4DCC1F7FC691458B90CDFAA36DCBE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....B.l.........." .........0...............................................@.......A....`A........................................p................0...............0..x&..............p............................................................................rdata..\|...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.6569647133331316
Encrypted:	false
SSDEEP:	192:dwWqhWWWEXCVWQ4mWLnySfKUSIX01k9z3AEXz5SLaDa3:iWqhWJhY2IR9z5YLt3
MD5:	C6024CC04201312F7688A021D25B056D
SHA1:	48A1D01AE8BC90F889FB5F09C0D2A0602EE4B0FD
SHA-256:	8751D30DF554AF08EF42D2FAA0A71ABCF8C7D17CE9E9FF2EA68A4662603EC500
SHA-512:	D86C773416B332945ACBB95CBE90E16730EF8E16B7F3CCD459D7131485760C2F07E95951AEB47C1CF29DE76AFFEB1C21BDF6D8260845E32205FE8411ED5EFA47
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...}.o..........." .........0...............................................@......v.....`A........................................p................0...............0..h&..............p............................................................................rdata..L...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.882042129450427
Encrypted:	false
SSDEEP:	192:9TvuBL3BBLAWqhWUWEXCVWQ4iWgdCLVx6RMySX01k9z3AzaXQ+BB:9TvuBL3BaWqhW/WSMR9zqaP
MD5:	1F2A00E72BC8FA2BD887BDB651ED6DE5
SHA1:	04D92E41CE002251CC09C297CF2B38C4263709EA
SHA-256:	9C8A08A7D40B6F697A21054770F1AFA9FFB197F90EF1EEE77C67751DF28B7142
SHA-512:	8CF72DF019F9FC9CD22FF77C37A563652BECEE0708FF5C6F1DA87317F41037909E64DCBDCC43E890C5777E6BCFA4035A27AFC1AEEB0F5DEBA878E3E9AEF7B02A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....g..........." .........0...............................................@............`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	5.355894399765837
Encrypted:	false
SSDEEP:	384:0naOMw3zdp3bwjGzue9/0jCRrndbnWqhW5lFydVXC4deR9zVj7xR:FOMwBprwjGzue9/0jCRrndbtGydVXC4O
MD5:	724223109E49CB01D61D63A8BE926B8F
SHA1:	072A4D01E01DBBAB7281D9BD3ADD76F9A3C8B23B
SHA-256:	4E975F618DF01A492AE433DFF0DD713774D47568E44C377CEEF9E5B34AAD1210
SHA-512:	19B0065B894DC66C30A602C9464F118E7F84D83010E74457D48E93AACA4422812B093B15247B24D5C398B42EF0319108700543D13F156067B169CCFB4D7B6B7C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...0.&3.........." .........0...............................................@......L0....`A........................................p................0...............0..h&..............p............................................................................rdata..D...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.771309314175772
Encrypted:	false
SSDEEP:	192:L0WqhWTWEXCVWQ4cRWdmjKDUX01k9z3AQyMX/7kn:L0WqhWol1pR9zzDY
MD5:	3C38AAC78B7CE7F94F4916372800E242
SHA1:	C793186BCF8FDB55A1B74568102B4E073F6971D6
SHA-256:	3F81A149BA3862776AF307D5C7FEEF978F258196F0A1BF909DA2D3F440FF954D
SHA-512:	C2746AA4342C6AFFFBD174819440E1BBF4371A7FED29738801C75B49E2F4F94FD6D013E002BAD2AADAFBC477171B8332C8C5579D624684EF1AFBFDE9384B8588
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...`.@f.........." .........0...............................................@......K.....`A........................................p...l............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.7115212149950185
Encrypted:	false
SSDEEP:	192:bWqhWUxWJWadJCsVWQ4mW5iFyttuX01k9z3A2EC:bWqhWUwCs8SR9zfEC
MD5:	321A3CA50E80795018D55A19BF799197
SHA1:	DF2D3C95FB4CBB298D255D342F204121D9D7EF7F
SHA-256:	5476DB3A4FECF532F96D48F9802C966FDEF98EC8D89978A79540CB4DB352C15F
SHA-512:	3EC20E1AC39A98CB5F726D8390C2EE3CD4CD0BF118FDDA7271F7604A4946D78778713B675D19DD3E1EC1D6D4D097ABE9CD6D0F76B3A7DFF53CE8D6DBC146870A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...j............" .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.893761152454321
Encrypted:	false
SSDEEP:	192:dEFP2WqhWVWEXCVWQ4mW68vx6RMySX01k9z3AzapOP:eF+WqhWi6gMR9zqa0
MD5:	0462E22F779295446CD0B63E61142CA5
SHA1:	616A325CD5B0971821571B880907CE1B181126AE
SHA-256:	0B6B598EC28A9E3D646F2BB37E1A57A3DDA069A55FBA86333727719585B1886E
SHA-512:	07B34DCA6B3078F7D1E8EDE5C639F697C71210DCF9F05212FD16EB181AB4AC62286BC4A7CE0D84832C17F5916D0224D1E8AAB210CEEFF811FC6724C8845A74FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...L.Y..........." .........0...............................................@............`A........................................p...H............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	5.231196901820079
Encrypted:	false
SSDEEP:	192:/Mck1JzX9cKSI0WqhWsWJWadJCsVWQ4mWClLeyttuX01k9z3A2XCJq:Uck1JzNcKSI0WqhWZCsvfSR9zfyk
MD5:	C3632083B312C184CBDD96551FED5519
SHA1:	A93E8E0AF42A144009727D2DECB337F963A9312E
SHA-256:	BE8D78978D81555554786E08CE474F6AF1DE96FCB7FA2F1CE4052BC80C6B2125
SHA-512:	8807C2444A044A3C02EF98CF56013285F07C4A1F7014200A21E20FCB995178BA835C30AC3889311E66BC61641D6226B1FF96331B019C83B6FCC7C87870CCE8C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....O.j.........." .........0...............................................@......9&....`A........................................p................0...............0..x&..............p............................................................................rdata..d...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.799245167892134
Encrypted:	false
SSDEEP:	192:R0DfIeUWqhWLWJWadJCsVWQ4mWFVyttuX01k9z3A2YHmp:R0DfIeUWqhWiCsLSR9zfYHmp
MD5:	517EB9E2CB671AE49F99173D7F7CE43F
SHA1:	4CCF38FED56166DDBF0B7EFB4F5314C1F7D3B7AB
SHA-256:	57CC66BF0909C430364D35D92B64EB8B6A15DC201765403725FE323F39E8AC54
SHA-512:	492BE2445B10F6BFE6C561C1FC6F5D1AF6D1365B7449BC57A8F073B44AE49C88E66841F5C258B041547FCD33CBDCB4EB9DD3E24F0924DB32720E51651E9286BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....#..........." .........0...............................................@.......,....`A........................................p................0...............0..x&..............p............................................................................rdata..\...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.587063911311469
Encrypted:	false
SSDEEP:	192:fWqhWeWJWadJCsVWQ4mWMs7DENNVAv+cQ0GX01k9z3ARoIGA/:fWqhWbCs8oNbZR9zQoxS
MD5:	F3FF2D544F5CD9E66BFB8D170B661673
SHA1:	9E18107CFCD89F1BBB7FDAF65234C1DC8E614ADD
SHA-256:	E1C5D8984A674925FA4AFBFE58228BE5323FE5123ABCD17EC4160295875A625F
SHA-512:	184B09C77D079127580EF80EB34BDED0F5E874CEFBE1C5F851D86861E38967B995D859E8491FCC87508930DC06C6BBF02B649B3B489A1B138C51A7D4B4E7AAAD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d......e.........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..P...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.754374422741657
Encrypted:	false
SSDEEP:	192:CGeVPWqhWUWJWadJCsVWQ4mWUhSqyttuX01k9z3A2lqn7cq:CGeVPWqhWBCsvoSR9zflBq
MD5:	A0C2DBE0F5E18D1ADD0D1BA22580893B
SHA1:	29624DF37151905467A223486500ED75617A1DFD
SHA-256:	3C29730DF2B28985A30D9C82092A1FAA0CEB7FFC1BD857D1EF6324CF5524802F
SHA-512:	3E627F111196009380D1687E024E6FFB1C0DCF4DCB27F8940F17FEC7EFDD8152FF365B43CB7FDB31DE300955D6C15E40A2C8FB6650A91706D7EA1C5D89319B12
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d......Z.........." .........0...............................................@............`A........................................p...<............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.664553499673792
Encrypted:	false
SSDEEP:	192:mZyMvr5WqhWAWJWadJCsVWQ4mWWqpNVAv+cQ0GX01k9z3ARo+GZ:mZyMvlWqhWNCsUpNbZR9zQo+GZ
MD5:	2666581584BA60D48716420A6080ABDA
SHA1:	C103F0EA32EBBC50F4C494BCE7595F2B721CB5AD
SHA-256:	27E9D3E7C8756E4512932D674A738BF4C2969F834D65B2B79C342A22F662F328
SHA-512:	BEFED15F11A0550D2859094CC15526B791DADEA12C2E7CEB35916983FB7A100D89D638FB1704975464302FAE1E1A37F36E01E4BEF5BC4924AB8F3FD41E60BD0C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....I..........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..l...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	5.146069394118203
Encrypted:	false
SSDEEP:	384:vUwidv3V0dfpkXc0vVaCsWqhWjCsa2IR9z5Bk5l:sHdv3VqpkXc0vVaP+U9zzk5l
MD5:	225D9F80F669CE452CA35E47AF94893F
SHA1:	37BD0FFC8E820247BD4DB1C36C3B9F9F686BBD50
SHA-256:	61C0EBE60CE6EBABCB927DDFF837A9BF17E14CD4B4C762AB709E630576EC7232
SHA-512:	2F71A3471A9868F4D026C01E4258AFF7192872590F5E5C66AABD3C088644D28629BA8835F3A4A23825631004B1AFD440EFE7161BB9FC7D7C69E0EE204813CA7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....x.........." .........0...............................................@.......J....`A........................................p...X............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.834520503429805
Encrypted:	false
SSDEEP:	192:etZ3xWqhWqWJWadJCsVWQ4mWfH/fKUSIX01k9z3AEXz40OY:etZ3xWqhWHCsMH2IR9z5OY
MD5:	1281E9D1750431D2FE3B480A8175D45C
SHA1:	BC982D1C750B88DCB4410739E057A86FF02D07EF
SHA-256:	433BD8DDC4F79AEE65CA94A54286D75E7D92B019853A883E51C2B938D2469BAA
SHA-512:	A954E6CE76F1375A8BEAC51D751B575BBC0B0B8BA6AA793402B26404E45718165199C2C00CCBCBA3783C16BDD96F0B2C17ADDCC619C39C8031BECEBEF428CE77
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................." .........0...............................................@.......w....`A........................................p...x............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.916367637528538
Encrypted:	false
SSDEEP:	192:qaIMFSYWqhWzWJWadJCsVWQ4mW14LyttuX01k9z3A2ClV:qdYWqhWqCsISR9zfCT
MD5:	FD46C3F6361E79B8616F56B22D935A53
SHA1:	107F488AD966633579D8EC5EB1919541F07532CE
SHA-256:	0DC92E8830BC84337DCAE19EF03A84EF5279CF7D4FDC2442C1BC25320369F9DF
SHA-512:	3360B2E2A25D545CCD969F305C4668C6CDA443BBDBD8A8356FFE9FBC2F70D90CF4540F2F28C9ED3EEA6C9074F94E69746E7705E6254827E6A4F158A75D81065B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...~.l-.........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.829681745003914
Encrypted:	false
SSDEEP:	192:HNpWqhW5WJWadJCsVWQ4mWbZyttuX01k9z3A2qkFU:HXWqhW4Cs1SR9zf9U
MD5:	D12403EE11359259BA2B0706E5E5111C
SHA1:	03CC7827A30FD1DEE38665C0CC993B4B533AC138
SHA-256:	F60E1751A6AC41F08E46480BF8E6521B41E2E427803996B32BDC5E78E9560781
SHA-512:	9004F4E59835AF57F02E8D9625814DB56F0E4A98467041DA6F1367EF32366AD96E0338D48FFF7CC65839A24148E2D9989883BCDDC329D9F4D27CAE3F843117D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...>.os.........." .........0...............................................@............`A........................................p...H............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.612408827336625
Encrypted:	false
SSDEEP:	192:CWqhW+WJWadJCsVWQ4mWprgfKUSIX01k9z3AEXzh:CWqhW7Cs12IR9z5F
MD5:	0F129611A4F1E7752F3671C9AA6EA736
SHA1:	40C07A94045B17DAE8A02C1D2B49301FAD231152
SHA-256:	2E1F090ABA941B9D2D503E4CD735C958DF7BB68F1E9BDC3F47692E1571AAAC2F
SHA-512:	6ABC0F4878BB302713755A188F662C6FE162EA6267E5E1C497C9BA9FDDBDAEA4DB050E322CB1C77D6638ECF1DAD940B9EBC92C43ACAA594040EE58D313CBCFAE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....+..........." .........0...............................................@............`A........................................p...<............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.918215004381039
Encrypted:	false
SSDEEP:	192:OvMWqhWkWJWadJCsVWQ4mWoz/HyttuX01k9z3A21O:JWqhWxCs/SSR9zf1O
MD5:	D4FBA5A92D68916EC17104E09D1D9D12
SHA1:	247DBC625B72FFB0BF546B17FB4DE10CAD38D495
SHA-256:	93619259328A264287AEE7C5B88F7F0EE32425D7323CE5DC5A2EF4FE3BED90D5
SHA-512:	D5A535F881C09F37E0ADF3B58D41E123F527D081A1EBECD9A927664582AE268341771728DC967C30908E502B49F6F853EEAEBB56580B947A629EDC6BCE2340D8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...Aj............" .........0...............................................@......UJ....`A.........................................................0...............0..x&..............p............................................................................rdata..p...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26216
Entropy (8bit):	4.882777558752248
Encrypted:	false
SSDEEP:	192:I9cy5WqhWKWEXCVWQ4mW1pbm6yttuX01k9z3A2jyM:Ry5WqhWdcbmLSR9zfjj
MD5:	EDF71C5C232F5F6EF3849450F2100B54
SHA1:	ED46DA7D59811B566DD438FA1D09C20F5DC493CE
SHA-256:	B987AB40CDD950EBE7A9A9176B80B8FFFC005CCD370BB1CBBCAD078C1A506BDC
SHA-512:	481A3C8DC5BEF793EE78CE85EC0F193E3E9F6CD57868B813965B312BD0FADEB5F4419707CD3004FBDB407652101D52E061EF84317E8BD458979443E9F8E4079A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...U.gJ.........." .........@...............................................P............`A.........................................................@...............@..h&..............p............................................................................rdata..n........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.738587310329139
Encrypted:	false
SSDEEP:	192:TWqhWXWEXCVWQ4mWPXTNyttuX01k9z3A2dGxr:TWqhWMKASR9zfYxr
MD5:	F9235935DD3BA2AA66D3AA3412ACCFBF
SHA1:	281E548B526411BCB3813EB98462F48FFAF4B3EB
SHA-256:	2F6BD6C235E044755D5707BD560A6AFC0BA712437530F76D11079D67C0CF3200
SHA-512:	AD0C0A7891FB8328F6F0CF1DDC97523A317D727C15D15498AFA53C07610210D2610DB4BC9BD25958D47ADC1AF829AD4D7CF8AABCAB3625C783177CCDB7714246
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...9.4o.........." .........0...............................................@......h*....`A............................................"............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	5.202163846121633
Encrypted:	false
SSDEEP:	192:2pUEpnWlC0i5CBWqhWXLeWEXCVWQ4iW+/x6RMySX01k9z3Aza8Az629:2ptnWm5CBWqhWtWMR9zqaH629
MD5:	5107487B726BDCC7B9F7E4C2FF7F907C
SHA1:	EBC46221D3C81A409FAB9815C4215AD5DA62449C
SHA-256:	94A86E28E829276974E01F8A15787FDE6ED699C8B9DC26F16A51765C86C3EADE
SHA-512:	A0009B80AD6A928580F2B476C1BDF4352B0611BB3A180418F2A42CFA7A03B9F0575ED75EC855D30B26E0CCA96A6DA8AFFB54862B6B9AFF33710D2F3129283FAA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...2............." .........0...............................................@......M4....`A.........................................................0...............0..h&..............p............................................................................rdata..0...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.866983142029453
Encrypted:	false
SSDEEP:	192:0vh8Y17aFBRsWqhW9AWEXCVWQ4mWCB4Lrp0KBQfX01k9z3ALkg5Z7:SL5WqhW9boRxB+R9z2kM7
MD5:	D5D77669BD8D382EC474BE0608AFD03F
SHA1:	1558F5A0F5FACC79D3957FF1E72A608766E11A64
SHA-256:	8DD9218998B4C4C9E8D8B0F8B9611D49419B3C80DAA2F437CBF15BCFD4C0B3B8
SHA-512:	8DEFA71772105FD9128A669F6FF19B6FE47745A0305BEB9A8CADB672ED087077F7538CD56E39329F7DAA37797A96469EAE7CD5E4CCA57C9A183B35BDC44182F3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...."]..........." .........0...............................................@............`A.........................................................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.828044267819929
Encrypted:	false
SSDEEP:	192:dUnWqhWRWJWadJCsVWQ4mW+2PyttuX01k9z3A23y:cWqhWQCsHSR9zf3y
MD5:	650435E39D38160ABC3973514D6C6640
SHA1:	9A5591C29E4D91EAA0F12AD603AF05BB49708A2D
SHA-256:	551A34C400522957063A2D71FA5ABA1CD78CC4F61F0ACE1CD42CC72118C500C0
SHA-512:	7B4A8F86D583562956593D27B7ECB695CB24AB7192A94361F994FADBA7A488375217755E7ED5071DE1D0960F60F255AA305E9DD477C38B7BB70AC545082C9D5E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...6..q.........." .........0...............................................@.......-....`A............................................e............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30328
Entropy (8bit):	5.14173409150951
Encrypted:	false
SSDEEP:	384:r7yaFM4Oe59Ckb1hgmLVWqhW2CsWNbZR9zQoekS:/FMq59Bb1jnoFT9zGp
MD5:	B8F0210C47847FC6EC9FBE2A1AD4DEBB
SHA1:	E99D833AE730BE1FEDC826BF1569C26F30DA0D17
SHA-256:	1C4A70A73096B64B536BE8132ED402BCFB182C01B8A451BFF452EFE36DDF76E7
SHA-512:	992D790E18AC7AE33958F53D458D15BFF522A3C11A6BD7EE2F784AC16399DE8B9F0A7EE896D9F2C96D1E2C8829B2F35FF11FC5D8D1B14C77E22D859A1387797C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................" .........P...............................................`............`A.............................................%...........P...............P..x&..............p............................................................................rdata...'.......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.883012715268179
Encrypted:	false
SSDEEP:	192:5eXrqjd7ZWqhW3WEXCVWQ4mW3Ql1Lrp0KBQfX01k9z3ALkjY/12:54rgWqhWsP1RxB+R9z2kjY/Y
MD5:	272C0F80FD132E434CDCDD4E184BB1D8
SHA1:	5BC8B7260E690B4D4039FE27B48B2CECEC39652F
SHA-256:	BD943767F3E0568E19FB52522217C22B6627B66A3B71CD38DD6653B50662F39D
SHA-512:	94892A934A92EF1630FBFEA956D1FE3A3BFE687DEC31092828960968CB321C4AB3AF3CAF191D4E28C8CA6B8927FBC1EC5D17D5C8A962C848F4373602EC982CD4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...<SdT.........." .........0...............................................@......N.....`A............................................x............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26208
Entropy (8bit):	5.023753175006074
Encrypted:	false
SSDEEP:	192:4mGqX8mPrpJhhf4AN5/KiFWqhWyzWEXCVWQ4OW4034hHssDX01k9z3AaYX2cWo:4ysyr77WqhWyI0oFDR9z9YH9
MD5:	20C0AFA78836B3F0B692C22F12BDA70A
SHA1:	60BB74615A71BD6B489C500E6E69722F357D283E
SHA-256:	962D725D089F140482EE9A8FF57F440A513387DD03FDC06B3A28562C8090C0BC
SHA-512:	65F0E60136AB358661E5156B8ECD135182C8AAEFD3EC320ABDF9CFC8AEAB7B68581890E0BBC56BAD858B83D47B7A0143FA791195101DC3E2D78956F591641D16
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....TR.........." .........@...............................................P......D!....`A............................................4............@...............@..`&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26232
Entropy (8bit):	5.289041983400337
Encrypted:	false
SSDEEP:	192:UuV2OlkuWYFxEpahfWqhWNWJWadJCsVWQ4mWeX9UfKUSIX01k9z3AEXzGd5S:dV2oFVhfWqhWMCstE2IR9z5Sd5S
MD5:	96498DC4C2C879055A7AFF2A1CC2451E
SHA1:	FECBC0F854B1ADF49EF07BEACAD3CEC9358B4FB2
SHA-256:	273817A137EE049CBD8E51DC0BB1C7987DF7E3BF4968940EE35376F87EF2EF8D
SHA-512:	4E0B2EF0EFE81A8289A447EB48898992692FEEE4739CEB9D87F5598E449E0059B4E6F4EB19794B9DCDCE78C05C8871264797C14E4754FD73280F37EC3EA3C304
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...k. U.........." .........@...............................................P............`A............................................a............@...............@..x&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26232
Entropy (8bit):	5.284932479906984
Encrypted:	false
SSDEEP:	384:tCLx0C5yguNvZ5VQgx3SbwA7yMVIkFGlTWqhWbQCsMSR9zful:tCV5yguNvZ5VQgx3SbwA71IkFGqHe9zI
MD5:	115E8275EB570B02E72C0C8A156970B3
SHA1:	C305868A014D8D7BBEF9ABBB1C49A70E8511D5A6
SHA-256:	415025DCE5A086DBFFC4CF322E8EAD55CB45F6D946801F6F5193DF044DB2F004
SHA-512:	B97EF7C5203A0105386E4949445350D8FF1C83BDEAEE71CCF8DC22F7F6D4F113CB0A9BE136717895C36EE8455778549F629BF8D8364109185C0BF28F3CB2B2CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.... .h.........." .........@...............................................P......\.....`A.........................................................@...............@..x&..............p............................................................................rdata.._........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	5.253102285412285
Encrypted:	false
SSDEEP:	192:mt3hwDGWqhWrWEXCVWQ4mWn+deyttuX01k9z3A23x:AWqhWgPSR9zfh
MD5:	001E60F6BBF255A60A5EA542E6339706
SHA1:	F9172EC37921432D5031758D0C644FE78CDB25FA
SHA-256:	82FBA9BC21F77309A649EDC8E6FC1900F37E3FFCB45CD61E65E23840C505B945
SHA-512:	B1A6DC5A34968FBDC8147D8403ADF8B800A06771CC9F15613F5CE874C29259A156BAB875AAE4CAAEC2117817CE79682A268AA6E037546AECA664CD4EEA60ADBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...G............" .........0...............................................@.......&....`A.........................................................0...............0..h&..............p............................................................................rdata..=...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.810971823417463
Encrypted:	false
SSDEEP:	192:p/fHQduDWqhWJWJWadJCsVWQ4mWxrnyttuX01k9z3A2Yv6WT:p/ftWqhWoCsmySR9zfYvvT
MD5:	A0776B3A28F7246B4A24FF1B2867BDBF
SHA1:	383C9A6AFDA7C1E855E25055AAD00E92F9D6AAFF
SHA-256:	2E554D9BF872A64D2CD0F0EB9D5A06DEA78548BC0C7A6F76E0A0C8C069F3C0A9
SHA-512:	7C9F0F8E53B363EF5B2E56EEC95E7B78EC50E9308F34974A287784A1C69C9106F49EA2D9CA037F0A7B3C57620FCBB1C7C372F207C68167DF85797AFFC3D7F3BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...2............." .........0...............................................@......^.....`A............................................^............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\base_library.zip

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1334069
Entropy (8bit):	5.58784984725534
Encrypted:	false
SSDEEP:	12288:NttcY+bS4OmE1jc+fYNXPh26UZWAzLX7jOIqL3QtltIrdmoP0Hz1dc+4/BaYcUi:NttcY+NHSPL/eMKrdmoPuzFcaYcUi
MD5:	55DF3C98D18EC80BC37A6682BA0ABCBB
SHA1:	E3BF60CFECFEE2473D4E0B07057AF3C27AFA6567
SHA-256:	D8DE678C0AC0CECB7BE261BDA75511C47E6A565F0C6260EACF240C7C5039753B
SHA-512:	26368C9187155EE83C450BFC792938A2908C473BA60330CE95BCC3F780390043879BBFF3949BD4A25B38343EAC3C5C9BA709267959109C9C99A229809C97F3BD
Malicious:	false
Preview:	PK..........!..............._collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI63402\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291528
Entropy (8bit):	6.047650375646611
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5NP:QWb/TRJLWURrI5RWavdF0J
MD5:	181AC9A809B1A8F1BC39C1C5C777CF2A
SHA1:	9341E715CEA2E6207329E7034365749FCA1F37DC
SHA-256:	488BA960602BF07CC63F4EF7AEC108692FEC41820FC3328A8E3F3DE038149AEE
SHA-512:	E19A92B94AEDCF1282B3EF561BD471EA19ED361334092C55D72425F9183EBD1D30A619E493841B6F75C629F26F28DC682960977941B486C59475F21CF86FFF85
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI63402\charset_normalizer\md.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.674392865869017
Encrypted:	false
SSDEEP:	96:KGUmje72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFXiHBpv9cX6gTim1qeSC:rjQ2HzzU2bRYoe1HH9cqgTimoe
MD5:	D9E0217A89D9B9D1D778F7E197E0C191
SHA1:	EC692661FCC0B89E0C3BDE1773A6168D285B4F0D
SHA-256:	ECF12E2C0A00C0ED4E2343EA956D78EED55E5A36BA49773633B2DFE7B04335C0
SHA-512:	3B788AC88C1F2D682C1721C61D223A529697C7E43280686B914467B3B39E7D6DEBAFF4C0E2F42E9DDDB28B522F37CB5A3011E91C66D911609C63509F9228133D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..............................M....................................... ...?.......?.......?.a.....?.......Rich............................PE..d....jAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	5.917175475547778
Encrypted:	false
SSDEEP:	3072:bA3W6Fck6/g5DzNa4cMy/dzpd1dhdMdJGFEr6/vD:MW6NzcMy/d13FErgvD
MD5:	BF9A9DA1CF3C98346002648C3EAE6DCF
SHA1:	DB16C09FDC1722631A7A9C465BFE173D94EB5D8B
SHA-256:	4107B1D6F11D842074A9F21323290BBE97E8EED4AA778FBC348EE09CC4FA4637
SHA-512:	7371407D12E632FC8FB031393838D36E6A1FE1E978CED36FF750D84E183CDE6DD20F75074F4597742C9F8D6F87AF12794C589D596A81B920C6C62EE2BA2E5654
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..r...r...r......r...s...r...s...r...w...r...v..r...q...r.#.s...r...s...r..8z...r..8r...r..8....r..8p...r.Rich..r.........................PE..d....jAe.........." ...%.:...........<.......................................0............`.........................................@...d.......................(............ ......P...................................@............P...............................text....8.......:.................. ..`.rdata...W...P...X...>..............@..@.data...8=.......0..................@....pdata..(...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5191960
Entropy (8bit):	5.962142634441191
Encrypted:	false
SSDEEP:	98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
MD5:	E547CF6D296A88F5B1C352C116DF7C0C
SHA1:	CAFA14E0367F7C13AD140FD556F10F320A039783
SHA-256:	05FE080EAB7FC535C51E10C1BD76A2F3E6217F9C91A25034774588881C3F99DE
SHA-512:	9F42EDF04C7AF350A00FA4FDF92B8E2E6F47AB9D2D41491985B20CD0ADDE4F694253399F6A88F4BDD765C4F49792F25FB01E84EC03FD5D0BE8BB61773D77D74D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l......l...m..l...i..l...h..l...o..l..m.y.l...m...l...o..l...h.l...l..l......l...n..l.Rich.l.........PE..d......e.........." ...%..7..4......v.........................................O.......P...`.........................................P.H.0....kN.@.....N.\|.....K.d.....O../....N....P.C.8.............................C.@............`N..............................text.....7.......7................. ..`.rdata....... 7.......7.............@..@.data....n....K..<....J.............@....pdata..0.....K......4K.............@..@.idata...%...`N..&....N.............@..@.00cfg..u.....N.......N.............@..@.rsrc...\|.....N......0N.............@..@.reloc........N......8N.............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	787224
Entropy (8bit):	5.609561366841894
Encrypted:	false
SSDEEP:	12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
MD5:	19A2ABA25456181D5FB572D88AC0E73E
SHA1:	656CA8CDFC9C3A6379536E2027E93408851483DB
SHA-256:	2E9FBCD8F7FDC13A5179533239811456554F2B3AA2FB10E1B17BE0DF81C79006
SHA-512:	DF17DC8A882363A6C5A1B78BA3CF448437D1118CCC4A6275CC7681551B13C1A4E0F94E30FFB94C3530B688B62BFF1C03E57C2C185A7DF2BF3E5737A06E114337
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>:V.PiV.PiV.Pi_..iX.PiC.QhT.Pi..QhT.PiC.UhZ.PiC.Th^.PiC.ShR.PillQhU.PiV.QiH.PillThf.PillPhW.Pill.iW.PillRhW.PiRichV.Pi................PE..d......e.........." ...%...........K........................................ ............`..........................................g...Q..............s.......@M......./......`.......8...........................`...@............p...............................text...D)......................... ..`.rdata..Hy...@...z..................@..@.data....N.......H..................@....pdata...V.......X..................@..@.idata...c...p...d...H..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..4...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\python312.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6926616
Entropy (8bit):	5.7675148099570395
Encrypted:	false
SSDEEP:	49152:PPknDqOJlpxSupRo2vXDZ2lgghXQIX2CG4Ts99kdwQAvyodh1GCOepxk1NHh8yfE:kdlpx9p5Loehv6JfDvXHDMiETH+0Tn
MD5:	D521654D889666A0BC753320F071EF60
SHA1:	5FD9B90C5D0527E53C199F94BAD540C1E0985DB6
SHA-256:	21700F0BAD5769A1B61EA408DC0A140FFD0A356A774C6EB0CC70E574B929D2E2
SHA-512:	7A726835423A36DE80FB29EF65DFE7150BD1567CAC6F3569E24D9FE091496C807556D0150456429A3D1A6FD2ED0B8AE3128EA3B8674C97F42CE7C897719D2CD3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..N%..N%..N%......L%....m.@%......J%......F%......C%..G]..T%...]..E%..N%..>$..]....%..]...O%..].o.O%..]...O%..RichN%..........................PE..d.....bf.........." ...(..(..<B......w.......................................pj.....[.j...`..........................................VN.d...D$O.......i......._..J....i../....i..[....2.T.....................H.(.....2.@.............(..............................text.....'.......(................. ..`.rdata...9'...(..:'...(.............@..@.data....L...PO......>O.............@....pdata...J...._..L....^.............@..@PyRuntim0.....a.......a.............@....rsrc.........i.......h.............@..@.reloc...[....i..\...&h.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\select.pyd

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31000
Entropy (8bit):	6.554631307714331
Encrypted:	false
SSDEEP:	384:2RVBC9t6Lhz64wHqFslDT90YpISQGrHQIYiSy1pCQ+42AM+o/8E9VF0Nyes:YGyIHqG1HpISQG75YiSyvB2AMxkEp
MD5:	D0CC9FC9A0650BA00BD206720223493B
SHA1:	295BC204E489572B74CC11801ED8590F808E1618
SHA-256:	411D6F538BDBAF60F1A1798FA8AA7ED3A4E8FCC99C9F9F10D21270D2F3742019
SHA-512:	D3EBCB91D1B8AA247D50C2C4B2BA1BF3102317C593CBF6C63883E8BF9D6E50C0A40F149654797ABC5B4F17AEE282DDD972A8CD9189BFCD5B9CEC5AB9C341E20B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t..'..'..'..g'..'...&..'...&..'...&..'...&..'...&..'..'...'...&..'...&..'...&..'...'..'...&..'Rich..'........PE..d.....bf.........." ...(.....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...`....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1016584
Entropy (8bit):	6.669319438805479
Encrypted:	false
SSDEEP:	24576:VkmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkA:mmZFHhp9v1Io3h0TN3pvkA
MD5:	0E0BAC3D1DCC1833EAE4E3E4CF83C4EF
SHA1:	4189F4459C54E69C6D3155A82524BDA7549A75A6
SHA-256:	8A91052EF261B5FBF3223AE9CE789AF73DFE1E9B0BA5BDBC4D564870A24F2BAE
SHA-512:	A45946E3971816F66DD7EA3788AACC384A9E95011500B458212DC104741315B85659E0D56A41570731D338BDF182141C093D3CED222C007038583CEB808E26FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..l9F.l9F.l9F...F.l9F.l8F.l9F...F.l9F..9G.l9F..:G.l9F..<G.l9F..7G.n9F..=G.l9F...F.l9F..;G.l9FRich.l9F........PE..d.....}X.........." .........`............................................................`A................................................p......................F...=......p...PX..T............................'...............O...............................text............................... ..`.rdata..<u.......v..................@..@.data....$...........r..............@....pdata.............................@..@.rsrc................4..............@..@.reloc..p............:..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63402\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\LKEAHetlG6.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1138456
Entropy (8bit):	5.461934346955969
Encrypted:	false
SSDEEP:	12288:LrEHdcM6hbqCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAjL:LrEXPCjfk7bPNfv42BN6yzUAjL
MD5:	CC8142BEDAFDFAA50B26C6D07755C7A6
SHA1:	0FCAB5816EAF7B138F22C29C6D5B5F59551B39FE
SHA-256:	BC2CF23B7B7491EDCF03103B78DBAF42AFD84A60EA71E764AF9A1DDD0FE84268
SHA-512:	C3B0C1DBE5BF159AB7706F314A75A856A08EBB889F53FE22AB3EC92B35B5E211EDAB3934DF3DA64EBEA76F38EB9BFC9504DB8D7546A36BC3CABE40C5599A9CBD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.....}...}...}......}..\|...}..~...}..y...}..x...}..-\|...}.H.\|...}...\|.S.}..-p...}..-}...}..-....}..-....}.Rich..}.........................PE..d.....bf.........." ...(.@..........0*.......................................p............`.........................................p...X............P.......@.......0.../...`......P^..T............................]..@............P..p............................text...!>.......@.................. ..`.rdata..\....P.......D..............@..@.data........ ......................@....pdata.......@......................@..@.rsrc........P.......$..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.992724184250649
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LKEAHetlG6.exe
File size:	9'300'301 bytes
MD5:	56407455f0d9001e20b5bb55aacedb69
SHA1:	831304ec839bdc1fa40c71c48eb2ef3872ba28a7
SHA256:	c4f3815a85c4c42379e5a5fadeddfd6a5c412ab48b628ad6d07d85eb5827a009
SHA512:	e8e744bdb9e75d0e003139f99625b8c675d95189734ac3c5200e98b0c680a94852c7bb127dde1902e203a4d8b5b024df0f1f97ac8bb06e4c7769f01f065caa9d
SSDEEP:	196608:d7Xg49UERBA1HeT39IigQh1ncKOVVtgSE37cdEtQtNQGxwKF:dr5q1+TtIiLv0VlCME6CO
TLSH:	A796339173E20CF6E66B943B8471CF25EAA3BC584322C68F53D44AD32F531929D39B52
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.CU3.-.3.-.3.-.x...4.-.x.(...-.x.).9.-..;..0.-..;..:.-..;).".-..;(...-.x.,.4.-.3.,.O.-. <).*.-. </.2.-.Rich3.-.........PE..d..

File Icon


Icon Hash:	2e1e7c4c4c61e979

Static PE Info

General

Entrypoint:	0x14000b4d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A00558 [Tue Jul 23 19:32:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ba2fe82dbe3fc8bdddc26ef88c3ef15a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F9C3862FD5Ch
dec eax
add esp, 28h
jmp 00007F9C3862F96Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F9C386300E8h
test eax, eax
je 00007F9C3862FB23h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F9C3862FB07h
dec eax
cmp ecx, eax
je 00007F9C3862FB16h
xor eax, eax
dec eax
cmpxchg dword ptr [0003A03Ch], ecx
jne 00007F9C3862FAF0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F9C3862FAF9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F9C3862FB09h
mov byte ptr [0003A025h], 00000001h
call 00007F9C3862F245h
call 00007F9C38630500h
test al, al
jne 00007F9C3862FB06h
xor al, al
jmp 00007F9C3862FB16h
call 00007F9C3863E9CFh
test al, al
jne 00007F9C3862FB0Bh
xor ecx, ecx
call 00007F9C38630510h
jmp 00007F9C3862FAECh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [00039FECh], 00000000h
mov ebx, ecx
jne 00007F9C3862FB69h
cmp ecx, 01h
jnbe 00007F9C3862FB6Ch
call 00007F9C3863005Eh
test eax, eax
je 00007F9C3862FB2Ah
test ebx, ebx
jne 00007F9C3862FB26h
dec eax
lea ecx, dword ptr [00039FD6h]
call 00007F9C3863E7C2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3d694	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4a000	0xef8c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x47000	0x22c8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x59000	0x768	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3ac60	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3ab20	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2c000	0x398	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2a2b0	0x2a400	e053bf2f68c38f61c99aca86be7960dd	False	0.5460082285502958	data	6.489919752629757	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2c000	0x1233a	0x12400	2f1755e05d4519a381ed55b58399a0f3	False	0.5267417594178082	data	5.783019917218662	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3f000	0x73e8	0xe00	0a0e29468eba7a0d037450c69e0a49c7	False	0.134765625	data	1.846104717976044	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x47000	0x22c8	0x2400	0c9766474f47260d6400d369145300b2	False	0.4747178819444444	data	5.345499890484728	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x4a000	0xef8c	0xf000	182535996cad843065a3dadaf64df887	False	0.8010091145833333	data	7.350145587019619	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x59000	0x768	0x800	20f278305f39ce7b0fa7b6fef8861e19	False	0.52099609375	data	5.224382024500949	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x4a208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.56636460554371
RT_ICON	0x4b0b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7287906137184116
RT_ICON	0x4b958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.7471098265895953
RT_ICON	0x4bec0	0x909b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9971636186822983
RT_ICON	0x54f5c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.38309128630705397
RT_ICON	0x57504	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.4826454033771107
RT_ICON	0x585ac	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.699468085106383
RT_GROUP_ICON	0x58a14	0x68	data	0.7019230769230769
RT_MANIFEST	0x58a7c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	GetWindowThreadProcessId, ShowWindow
KERNEL32.dll	GetModuleFileNameW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, CreateDirectoryW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, WaitForSingleObject, FormatMessageW, GetCurrentProcess, GetCurrentProcessId, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, LocalFree, SetConsoleCtrlHandler, GetConsoleWindow, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, HeapReAlloc, GetLastError, WriteConsoleW, SetEndOfFile, Sleep, EnterCriticalSection, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetModuleHandleW, RtlUnwindEx, SetLastError, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, GetCommandLineA, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetCurrentDirectoryW, FlushFileBuffers, SetEnvironmentVariableW, GetFileAttributesExW, GetStringTypeW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize
ADVAPI32.dll	ConvertSidToStringSidW, GetTokenInformation, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 3, 2024 09:57:06.499998093 CEST	49705	443	192.168.2.5	149.137.136.16
Aug 3, 2024 09:57:06.500078917 CEST	443	49705	149.137.136.16	192.168.2.5
Aug 3, 2024 09:57:06.500262976 CEST	49705	443	192.168.2.5	149.137.136.16
Aug 3, 2024 09:57:06.500962019 CEST	49705	443	192.168.2.5	149.137.136.16
Aug 3, 2024 09:57:06.501009941 CEST	443	49705	149.137.136.16	192.168.2.5
Aug 3, 2024 09:57:07.007666111 CEST	443	49705	149.137.136.16	192.168.2.5
Aug 3, 2024 09:57:07.008368015 CEST	49705	443	192.168.2.5	149.137.136.16
Aug 3, 2024 09:57:07.008413076 CEST	443	49705	149.137.136.16	192.168.2.5
Aug 3, 2024 09:57:07.010540962 CEST	443	49705	149.137.136.16	192.168.2.5
Aug 3, 2024 09:57:07.010636091 CEST	49705	443	192.168.2.5	149.137.136.16
Aug 3, 2024 09:57:07.011758089 CEST	49705	443	192.168.2.5	149.137.136.16
Aug 3, 2024 09:57:07.011897087 CEST	49705	443	192.168.2.5	149.137.136.16
Aug 3, 2024 09:57:07.014123917 CEST	49706	443	192.168.2.5	149.137.136.16
Aug 3, 2024 09:57:07.014183998 CEST	443	49706	149.137.136.16	192.168.2.5
Aug 3, 2024 09:57:07.014269114 CEST	49706	443	192.168.2.5	149.137.136.16
Aug 3, 2024 09:57:07.014638901 CEST	49706	443	192.168.2.5	149.137.136.16
Aug 3, 2024 09:57:07.014664888 CEST	443	49706	149.137.136.16	192.168.2.5
Aug 3, 2024 09:57:07.494265079 CEST	443	49706	149.137.136.16	192.168.2.5
Aug 3, 2024 09:57:07.494802952 CEST	49706	443	192.168.2.5	149.137.136.16
Aug 3, 2024 09:57:07.494821072 CEST	443	49706	149.137.136.16	192.168.2.5
Aug 3, 2024 09:57:07.498486042 CEST	443	49706	149.137.136.16	192.168.2.5
Aug 3, 2024 09:57:07.498585939 CEST	49706	443	192.168.2.5	149.137.136.16
Aug 3, 2024 09:57:07.499373913 CEST	49706	443	192.168.2.5	149.137.136.16
Aug 3, 2024 09:57:07.499481916 CEST	49706	443	192.168.2.5	149.137.136.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 3, 2024 09:57:06.489041090 CEST	53497	53	192.168.2.5	1.1.1.1
Aug 3, 2024 09:57:06.496846914 CEST	53	53497	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 3, 2024 09:57:06.489041090 CEST	192.168.2.5	1.1.1.1	0xa5c0	Standard query (0)	f005.backblazeb2.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 3, 2024 09:57:06.496846914 CEST	1.1.1.1	192.168.2.5	0xa5c0	No error (0)	f005.backblazeb2.com		149.137.136.16	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	03:56:59
Start date:	03/08/2024
Path:	C:\Users\user\Desktop\LKEAHetlG6.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\LKEAHetlG6.exe"
Imagebase:	0x7ff7e5d60000
File size:	9'300'301 bytes
MD5 hash:	56407455F0D9001E20B5BB55AACEDB69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:56:59
Start date:	03/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:57:01
Start date:	03/08/2024
Path:	C:\Users\user\Desktop\LKEAHetlG6.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\LKEAHetlG6.exe"
Imagebase:	0x7ff7e5d60000
File size:	9'300'301 bytes
MD5 hash:	56407455F0D9001E20B5BB55AACEDB69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:57:06
Start date:	03/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "kdmapper.exe drv.sys"
Imagebase:	0x7ff6c69f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 00007FF7E5D85F90 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7E5D85FD5

Part of subcall function 00007FF7E5D85928: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D8593C

Part of subcall function 00007FF7E5D7A574: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7E5D830B2,?,?,?,00007FF7E5D830EF,?,?,00000000,00007FF7E5D835B5,?,?,?,00007FF7E5D834E7), ref: 00007FF7E5D7A58A
Part of subcall function 00007FF7E5D7A574: GetLastError.KERNEL32(?,?,?,00007FF7E5D830B2,?,?,?,00007FF7E5D830EF,?,?,00000000,00007FF7E5D835B5,?,?,?,00007FF7E5D834E7), ref: 00007FF7E5D7A594

Part of subcall function 00007FF7E5D7A954: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7E5D7A933,?,?,?,?,?,00007FF7E5D7A81E), ref: 00007FF7E5D7A95D
Part of subcall function 00007FF7E5D7A954: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7E5D7A933,?,?,?,?,?,00007FF7E5D7A81E), ref: 00007FF7E5D7A982

_get_daylight.LIBCMT ref: 00007FF7E5D85FC4

Part of subcall function 00007FF7E5D85988: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D8599C

_get_daylight.LIBCMT ref: 00007FF7E5D8623A
_get_daylight.LIBCMT ref: 00007FF7E5D8624B
_get_daylight.LIBCMT ref: 00007FF7E5D8625C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E5D8649C), ref: 00007FF7E5D86283

Strings

Eastern Standard Time, xrefs: 00007FF7E5D86329
Eastern Summer Time, xrefs: 00007FF7E5D86341

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 1458651798-239921721
Opcode ID: 5d8ca302bc24518753303e1de9637dda799bc5a6da56782543b675025544b69d
Instruction ID: 1d8aa4930c3a64a11fdde48458f28e214c433d3ba20f0995045280f60047b630
Opcode Fuzzy Hash: 5d8ca302bc24518753303e1de9637dda799bc5a6da56782543b675025544b69d
Instruction Fuzzy Hash: 37D1A326E0821A85EB10FF25D4E03B9A661EB54FA4FC44137EA4DCB686DE3CE441C762

Function 00007FF7E5D86CF4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E5D86A28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D86A69
Part of subcall function 00007FF7E5D86A28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D86AE7
Part of subcall function 00007FF7E5D86A28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D86B38

CreateFileW.KERNELBASE ref: 00007FF7E5D86DFA
CreateFileW.KERNEL32 ref: 00007FF7E5D86E4A
GetLastError.KERNEL32 ref: 00007FF7E5D86E7A
GetFileType.KERNELBASE ref: 00007FF7E5D86E8F
GetLastError.KERNEL32 ref: 00007FF7E5D86E99
CloseHandle.KERNEL32 ref: 00007FF7E5D86ECC
CloseHandle.KERNEL32 ref: 00007FF7E5D8702F
CreateFileW.KERNEL32 ref: 00007FF7E5D87064
GetLastError.KERNEL32 ref: 00007FF7E5D87073

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 7e03ef3d0a20c94a2012376284489c35dd0980ac60203fd93d959aa726f203d8
Instruction ID: 84bb2e2ef4f60f4c9833d1c1e054364cd258cc40cbf93a89c79e1bf8e0c05d80
Opcode Fuzzy Hash: 7e03ef3d0a20c94a2012376284489c35dd0980ac60203fd93d959aa726f203d8
Instruction Fuzzy Hash: E4C1C132B28A4985EB10EF64D4E16AC7771E749FA8B814236DB1EDB794DF38E051C311

Function 00007FF7E5D66C30 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF7E5D671D9,00007FF7E5D62C43), ref: 00007FF7E5D66C9B
RemoveDirectoryW.KERNEL32 ref: 00007FF7E5D66D1E
DeleteFileW.KERNELBASE ref: 00007FF7E5D66D3D
FindNextFileW.KERNELBASE ref: 00007FF7E5D66D4B
FindClose.KERNEL32 ref: 00007FF7E5D66D5C
RemoveDirectoryW.KERNELBASE ref: 00007FF7E5D66D65

Strings

%s\*, xrefs: 00007FF7E5D66C62

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 06e408feea88f4fa5bbf8880914eb6697307b1059d5c84f9f3493ba60dd80eca
Instruction ID: 5d9ab014bf62b70268c30551e4e33366abaa8272ccfa74eed2716b7c4c4fa249
Opcode Fuzzy Hash: 06e408feea88f4fa5bbf8880914eb6697307b1059d5c84f9f3493ba60dd80eca
Instruction Fuzzy Hash: E741A161A0CD5A81EA20EB25E4E43B9A360FB94F94FC10333D65DC6694DF7CD94ACB12

Function 00007FF7E5D8620C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7E5D8623A

Part of subcall function 00007FF7E5D85988: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D8599C

_get_daylight.LIBCMT ref: 00007FF7E5D8624B

Part of subcall function 00007FF7E5D85928: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D8593C

_get_daylight.LIBCMT ref: 00007FF7E5D8625C

Part of subcall function 00007FF7E5D85958: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D8596C

Part of subcall function 00007FF7E5D7A574: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7E5D830B2,?,?,?,00007FF7E5D830EF,?,?,00000000,00007FF7E5D835B5,?,?,?,00007FF7E5D834E7), ref: 00007FF7E5D7A58A
Part of subcall function 00007FF7E5D7A574: GetLastError.KERNEL32(?,?,?,00007FF7E5D830B2,?,?,?,00007FF7E5D830EF,?,?,00000000,00007FF7E5D835B5,?,?,?,00007FF7E5D834E7), ref: 00007FF7E5D7A594

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E5D8649C), ref: 00007FF7E5D86283

Strings

Eastern Standard Time, xrefs: 00007FF7E5D86329
Eastern Summer Time, xrefs: 00007FF7E5D86341

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 2248164782-239921721
Opcode ID: d2e7218d2b32ac445d8d3c687af5ad0aa8287f8229169f051b9e9ef0101c51cb
Instruction ID: 8ee27bd43ee17b89b6dceec69bd9670fda615cb6b330dfc06c800c7eeef1add9
Opcode Fuzzy Hash: d2e7218d2b32ac445d8d3c687af5ad0aa8287f8229169f051b9e9ef0101c51cb
Instruction Fuzzy Hash: CF516F22E1864A86E710FF25E4E02A9A760FB58B94FC44137EA5DCB796DF3CE401C761

Function 00007FF7E5D67990 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7E5D679C3
FindClose.KERNELBASE ref: 00007FF7E5D679D2

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 0d24089257937bf4d8f75b282e589f98d2e605d2659b39465ed8206b1681d219
Instruction ID: bd70c973abb893a7a30716a83dd9b85d020a6e973b80047431b01720e5325092
Opcode Fuzzy Hash: 0d24089257937bf4d8f75b282e589f98d2e605d2659b39465ed8206b1681d219
Instruction Fuzzy Hash: 08F0C872A1C64AC6F760DB64B4E8366B390BB44B74F800337EAAE466D4DF7CD0498B01

Function 00007FF7E5D61000 Relevance: 40.6, APIs: 1, Strings: 22, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

minimize-early, xrefs: 00007FF7E5D62905
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7E5D62A95
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7E5D62A40
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7E5D629A4
pyi-contents-directory, xrefs: 00007FF7E5D627D5
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7E5D6288C
WARNING: failed to remove temporary directory: %s, xrefs: 00007FF7E5D62C8E
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7E5D62B74
pkg, xrefs: 00007FF7E5D628CF
pyi-runtime-tmpdir, xrefs: 00007FF7E5D627B0
hide-late, xrefs: 00007FF7E5D62922
Failed to convert DLL search path!, xrefs: 00007FF7E5D62B12
ERROR: failed to remove temporary directory: %s, xrefs: 00007FF7E5D62C6F
hide-early, xrefs: 00007FF7E5D62812
minimize-late, xrefs: 00007FF7E5D6293F
Could not create temporary directory!, xrefs: 00007FF7E5D62AAA
_MEIPASS2, xrefs: 00007FF7E5D629F2, 00007FF7E5D629FE, 00007FF7E5D62C09
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7E5D628EF
pyi-hide-console, xrefs: 00007FF7E5D627FA
Failed to start splash screen!, xrefs: 00007FF7E5D62BA2
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7E5D62B89
MEI, xrefs: 00007FF7E5D6284E

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: FileModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$hide-early$hide-late$minimize-early$minimize-late$pkg$pyi-contents-directory$pyi-hide-console$pyi-runtime-tmpdir
API String ID: 514040917-560148345
Opcode ID: 89f297846431eaa45ed7b160866f470024b357e96d8d12602c9828768cf20f43
Instruction ID: 80bb78816ac5842a7accb053fd8f9cb1ccb3faa5b08846ffe1cbba63402f27d8
Opcode Fuzzy Hash: 89f297846431eaa45ed7b160866f470024b357e96d8d12602c9828768cf20f43
Instruction Fuzzy Hash: D5024321A08A8B90EB11FB2594B43B99351AF54F84FC44273DA4DC66D6EFBCE546C332

Function 00007FF7E5D618D0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E5D66920: _fread_nolock.LIBCMT ref: 00007FF7E5D669CA

_fread_nolock.LIBCMT ref: 00007FF7E5D61994

Strings

Could not allocate memory for archive structure!, xrefs: 00007FF7E5D619CE
calloc, xrefs: 00007FF7E5D619D5
Failed to seek to cookie position!, xrefs: 00007FF7E5D61969
fseek, xrefs: 00007FF7E5D61970
Failed to read cookie!, xrefs: 00007FF7E5D6199F
malloc, xrefs: 00007FF7E5D61A88
Could not read full TOC!, xrefs: 00007FF7E5D61AB4
Could not allocate buffer for TOC!, xrefs: 00007FF7E5D61A81
fread, xrefs: 00007FF7E5D619A6, 00007FF7E5D61ABB
MEI, xrefs: 00007FF7E5D61911
Error on file., xrefs: 00007FF7E5D61AEA

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _fread_nolock
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 840049012-3497178890
Opcode ID: 35b129b812a0a2966b30bf5c49142a2709d60bba369b49f2dcb000f42a06eae3
Instruction ID: 07fa5c2ae3ade51ee55d144f5f55c2b0031b820dca9ee26c0f16a8f322b93139
Opcode Fuzzy Hash: 35b129b812a0a2966b30bf5c49142a2709d60bba369b49f2dcb000f42a06eae3
Instruction Fuzzy Hash: 7371D931A08A4AC9EB50FB54D4B03B9A360EB45F80F804233D54DCB755DEBCE1468762

Function 00007FF7E5D615A0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7E5D616CF
fwrite, xrefs: 00007FF7E5D6175C
Failed to create symbolic link %s!, xrefs: 00007FF7E5D615C2
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7E5D6163B
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7E5D61755
fopen, xrefs: 00007FF7E5D615FE
Failed to extract %s: failed to open target file!, xrefs: 00007FF7E5D615F7
fseek, xrefs: 00007FF7E5D61675
malloc, xrefs: 00007FF7E5D616D6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7E5D6166E
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7E5D61765
fread, xrefs: 00007FF7E5D6176C

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 115fde3aed781621350e5dce5a054658506e0732fc83d747eb2cfbdbf4a04440
Instruction ID: 795f0a6463f604fa0c7dfb82880dacfd38cc38344daec2bc1daf192905835ce7
Opcode Fuzzy Hash: 115fde3aed781621350e5dce5a054658506e0732fc83d747eb2cfbdbf4a04440
Instruction Fuzzy Hash: 08519161B08E4B91EA10FB5598A03B5A360FF44F94FC44233DA0D8B795DFBCE5568362

Function 00007FF7E5D66F20 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,00000000,FFFFFFFF,00007FF7E5D62AA6), ref: 00007FF7E5D66FC4
GetCurrentProcessId.KERNEL32(?,00000000,FFFFFFFF,00007FF7E5D62AA6), ref: 00007FF7E5D66FCA
CreateDirectoryW.KERNELBASE(?,00000000,FFFFFFFF,00007FF7E5D62AA6), ref: 00007FF7E5D6700C

Part of subcall function 00007FF7E5D670F0: GetEnvironmentVariableW.KERNEL32(00007FF7E5D629B0), ref: 00007FF7E5D67127
Part of subcall function 00007FF7E5D670F0: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7E5D67149

Part of subcall function 00007FF7E5D78284: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D7829D

Strings

_MEI%d, xrefs: 00007FF7E5D66FD2
TMP, xrefs: 00007FF7E5D66F82
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7E5D6703E
TMP, xrefs: 00007FF7E5D66F5C, 00007FF7E5D67063
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7E5D66F9C

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandPathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 365913792-1339014028
Opcode ID: 1449b93aaa976a4ce71a53240a133fe27ef9bf9782ccbfe34c5de52202063f60
Instruction ID: 674f375f4228f0b33538d9e0610d1a0e4d06f864330ffeb9b4c43b43aef62a97
Opcode Fuzzy Hash: 1449b93aaa976a4ce71a53240a133fe27ef9bf9782ccbfe34c5de52202063f60
Instruction Fuzzy Hash: B6418D11A08A4B81EA51F76599F03B9D351AF44F90FC01233EE0EC7696EE7CE5468762

Function 00007FF7E5D672A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E5D67AA0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7E5D631F4,00000000,00007FF7E5D61905), ref: 00007FF7E5D67AD9

SetConsoleCtrlHandler.KERNEL32(?,00007FF7E5D62C1D), ref: 00007FF7E5D672EA
GetStartupInfoW.KERNEL32 ref: 00007FF7E5D6730B

Part of subcall function 00007FF7E5D7A494: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D7A4A8

Part of subcall function 00007FF7E5D78768: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D787CF

GetCommandLineW.KERNEL32 ref: 00007FF7E5D673AD
CreateProcessW.KERNELBASE ref: 00007FF7E5D673EF
WaitForSingleObject.KERNEL32 ref: 00007FF7E5D67403
GetExitCodeProcess.KERNELBASE ref: 00007FF7E5D67413

Strings

CreateProcessW, xrefs: 00007FF7E5D67426
Failed to create child process!, xrefs: 00007FF7E5D6741F

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Failed to create child process!
API String ID: 2895956056-699529898
Opcode ID: ca2372baf2d8f4dd250c5c8e9e09b2c8f3e265623af2668934e9e1f2c31000e5
Instruction ID: 16a7d280481c8bef8cc812e5f39aa63b6f62124d67e72a9c80903c0bf66edffc
Opcode Fuzzy Hash: ca2372baf2d8f4dd250c5c8e9e09b2c8f3e265623af2668934e9e1f2c31000e5
Instruction Fuzzy Hash: 6A414731A08B8682DA20EB24F4A53AAF360FB84764FD00736E6AD877D5DF7CD0558B51

Function 00007FF7E5D611D0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7E5D613CE
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7E5D612A3
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7E5D61236
malloc, xrefs: 00007FF7E5D6127C, 00007FF7E5D612AA
1.3.1, xrefs: 00007FF7E5D61209
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7E5D61275

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 5f8f63999e10081a225424873084ffbe5f1b59f7a0f6780628ccd4fd4ef40fa2
Instruction ID: 51a695f167d61901357dd67956f5360947df1af5b271fba7dcd51a59c37b4751
Opcode Fuzzy Hash: 5f8f63999e10081a225424873084ffbe5f1b59f7a0f6780628ccd4fd4ef40fa2
Instruction Fuzzy Hash: 8551F722A08A4A81E660FB51A4E03BAA291BB44F94FC44337DD4EC7BD5EF7CD406C711

Function 00007FF7E5D7F08C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7E5D7F426,?,?,-00000018,00007FF7E5D7AD6B,?,?,?,00007FF7E5D7AC62,?,?,?,00007FF7E5D7600E), ref: 00007FF7E5D7F208
GetProcAddress.KERNEL32(?,?,?,00007FF7E5D7F426,?,?,-00000018,00007FF7E5D7AD6B,?,?,?,00007FF7E5D7AC62,?,?,?,00007FF7E5D7600E), ref: 00007FF7E5D7F214

Strings

api-ms-, xrefs: 00007FF7E5D7F152
ext-ms-, xrefs: 00007FF7E5D7F165

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 4d69cc593bfb997158b6c0c0c10d0034b2900934994469889e9651ec028d1562
Instruction ID: 843b80cfe0b7aa34f6f4e513cc3c0990333bd605157fcefc6591afd957b2f6d1
Opcode Fuzzy Hash: 4d69cc593bfb997158b6c0c0c10d0034b2900934994469889e9651ec028d1562
Instruction Fuzzy Hash: EE41D421B19A0A81EA25EB16D8A0775A395BF44FE0FC98137DD0DCB785EE3CE4458722

Function 00007FF7E5D7BB60 Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D7BF8D

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a7237f40ba55fbfcfd7203fc6e89763ccd47b5f3d6f0ac254d51dd75cb3de353
Instruction ID: 01258c459f189981fe8f91295d2fcfa7a7af43e00fbb02bff0f1fd171c994737
Opcode Fuzzy Hash: a7237f40ba55fbfcfd7203fc6e89763ccd47b5f3d6f0ac254d51dd75cb3de353
Instruction Fuzzy Hash: 2DC1D722A0C68A81F760EB15D4E43BDF760EB81F80FD54132DA4E87791EE7DE8458722

Function 00007FF7E5D66DD0 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7E5D66DF0
OpenProcessToken.ADVAPI32 ref: 00007FF7E5D66E03
GetTokenInformation.KERNELBASE ref: 00007FF7E5D66E28
GetLastError.KERNEL32 ref: 00007FF7E5D66E32
GetTokenInformation.KERNELBASE ref: 00007FF7E5D66E72
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7E5D66E8E
CloseHandle.KERNEL32 ref: 00007FF7E5D66EA6

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 8f9891b798483f92caab1560084f17c35a3d2f20a9512cd4f17cf036ff63b230
Instruction ID: b5da16eb7ef3b17f9dcaf9105e49667af0e68695ae5c75c9281c7f4cd9319265
Opcode Fuzzy Hash: 8f9891b798483f92caab1560084f17c35a3d2f20a9512cd4f17cf036ff63b230
Instruction Fuzzy Hash: 8A217521A0CA4681EB10EB55E4D0729E3A1EF81BA0F904736D66DC7AE9DFBCD845C711

Function 00007FF7E5D625A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7E5D626F4), ref: 00007FF7E5D625D1

Part of subcall function 00007FF7E5D61ED0: GetLastError.KERNEL32 ref: 00007FF7E5D61EEC
Part of subcall function 00007FF7E5D61ED0: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E5D625EE,?,00007FF7E5D626F4), ref: 00007FF7E5D61F56

Strings

GetModuleFileNameW, xrefs: 00007FF7E5D625E2
\\?\, xrefs: 00007FF7E5D62642
Failed to resolve full path to executable %ls., xrefs: 00007FF7E5D62621
Failed to convert executable path to UTF-8., xrefs: 00007FF7E5D62678
Failed to obtain executable path., xrefs: 00007FF7E5D625DB

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ErrorFileFormatLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 1234058594-2863816727
Opcode ID: 65b9fcef5ef1d5fe4a0761813f3a61d529644fdc59a7ebe131a5006a953f7c10
Instruction ID: 8ad491b3e1a303de3165155a8f6276a08e7878babfc67b5bc1ffdb7b3ceb333a
Opcode Fuzzy Hash: 65b9fcef5ef1d5fe4a0761813f3a61d529644fdc59a7ebe131a5006a953f7c10
Instruction Fuzzy Hash: E1219761B1894B81FA20F724E8F43B99251AF58B94FC00337E65DC65E6EEBCD5068722

Function 00007FF7E5D67730 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E5D66DD0: GetCurrentProcess.KERNEL32 ref: 00007FF7E5D66DF0
Part of subcall function 00007FF7E5D66DD0: OpenProcessToken.ADVAPI32 ref: 00007FF7E5D66E03
Part of subcall function 00007FF7E5D66DD0: GetTokenInformation.KERNELBASE ref: 00007FF7E5D66E28
Part of subcall function 00007FF7E5D66DD0: GetLastError.KERNEL32 ref: 00007FF7E5D66E32
Part of subcall function 00007FF7E5D66DD0: GetTokenInformation.KERNELBASE ref: 00007FF7E5D66E72
Part of subcall function 00007FF7E5D66DD0: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7E5D66E8E
Part of subcall function 00007FF7E5D66DD0: CloseHandle.KERNEL32 ref: 00007FF7E5D66EA6

LocalFree.KERNEL32(00000000,00007FF7E5D62A89), ref: 00007FF7E5D677BC
LocalFree.KERNEL32 ref: 00007FF7E5D677C5

Strings

D:(A;;FA;;;%s), xrefs: 00007FF7E5D677A7
S-1-3-4, xrefs: 00007FF7E5D67771
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7E5D677D3
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7E5D67792

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 556c69a12eea041b70645f2e07fe6d8c8337e702e53c411469b4cd7cd588f294
Instruction ID: 93f3314cc534eb442ca093aa97d64c06b040b11971646d347083ee3ecb5d0898
Opcode Fuzzy Hash: 556c69a12eea041b70645f2e07fe6d8c8337e702e53c411469b4cd7cd588f294
Instruction Fuzzy Hash: 34217361A08A4A81F610FB10E8A03E9E355EF84B80FC44133EA4DC7796DF7CD845C7A2

Function 00007FF7E5D667B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF7E5D6240C,?,?,00007FF7E5D62BD3), ref: 00007FF7E5D668C2

Strings

%.*s, xrefs: 00007FF7E5D6687B
\, xrefs: 00007FF7E5D66827
%s%c, xrefs: 00007FF7E5D66834

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: d2cc5cc4e3729b854815d16a88e1e58836d9ed8a05899cce8d8ad2b010cc0ecc
Instruction ID: c244ed97746432f0837931b509743e31d5c1033817432ecaa27ff634e910d530
Opcode Fuzzy Hash: d2cc5cc4e3729b854815d16a88e1e58836d9ed8a05899cce8d8ad2b010cc0ecc
Instruction Fuzzy Hash: 5531C961A19EC945EA21EB25E4B03E6A354EB44FE0F800332EA5DC77C5DE7CD246C711

Function 00007FF7E5D7D070 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E5D7D05B), ref: 00007FF7E5D7D18C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E5D7D05B), ref: 00007FF7E5D7D217

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: b8176ab0cd2342035d827acca107fdd4b2b6aaa1559c88639dfb2f89f9c6514b
Instruction ID: ca9cea58be3a92489ca4b6aab5eb19df1647c0788b4d4729c5aac56cd6f44cd5
Opcode Fuzzy Hash: b8176ab0cd2342035d827acca107fdd4b2b6aaa1559c88639dfb2f89f9c6514b
Instruction Fuzzy Hash: 0191B532B0865985F750FF6594E037DABA0FB44F88F94413ADE0E97695DE38E482C322

Function 00007FF7E5D7FD1C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7E5D7FE0C
_get_daylight.LIBCMT ref: 00007FF7E5D7FE1D
_get_daylight.LIBCMT ref: 00007FF7E5D7FE2E
_isindst.LIBCMT ref: 00007FF7E5D7FEF9

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4858f8cd19caa2a963f97c62f7cf419c6ccc0f2ddde666d924458c87d99ac7a2
Instruction ID: 52e4d0fc4e3a1b484f7fb02ef641a2cab7aacc78db1fe57eb946b48cf26e75d3
Opcode Fuzzy Hash: 4858f8cd19caa2a963f97c62f7cf419c6ccc0f2ddde666d924458c87d99ac7a2
Instruction Fuzzy Hash: 01510572F0415A8AEB24EB2498E17BCE7A1AB01B58FD00137DD2ED2AD5DF38A406C711

Function 00007FF7E5D75848 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF7E5D7587B
GetFileInformationByHandle.KERNELBASE ref: 00007FF7E5D758DD
GetLastError.KERNEL32 ref: 00007FF7E5D7596E
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E5D75780), ref: 00007FF7E5D759BA

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: c8443f222f7955abaccbd633dd6c0c22e009ea4c1ae81d7bc85d106a4d3da070
Instruction ID: a59e641068627cf8044d5e84e4d0572f518067f47636c008b4aca1b618e6afa4
Opcode Fuzzy Hash: c8443f222f7955abaccbd633dd6c0c22e009ea4c1ae81d7bc85d106a4d3da070
Instruction Fuzzy Hash: AE518022E08645CAF710EF70D4A03BDA3A1EB48F58F948536DE4D9B689DF38D4818762

Function 00007FF7E5D756F4 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D75721
CreateFileW.KERNELBASE ref: 00007FF7E5D75760
CloseHandle.KERNEL32 ref: 00007FF7E5D75795

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: dd7eac1057e584b1087a132c8893c35ef1df72ce863294a3bcebda750911c608
Instruction ID: b41b8078646817d050b7b0494476512e79bded1f2fdf5a9101a16107430dbffa
Opcode Fuzzy Hash: dd7eac1057e584b1087a132c8893c35ef1df72ce863294a3bcebda750911c608
Instruction Fuzzy Hash: 4541C932D1874683F750EB20D5A0379A360FB95B94F509336E65C47AD5EF7CA4E08712

Function 00007FF7E5D79A80 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7E5D79A7C), ref: 00007FF7E5D79A91
TerminateProcess.KERNEL32(?,?,?,00007FF7E5D79A7C), ref: 00007FF7E5D79A9C
ExitProcess.KERNEL32 ref: 00007FF7E5D79AAB

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2c24119f787965044d627fb85e1f935b4d689670476c95a23688f33a408cf2b4
Instruction ID: 8738c7caec70a2ce43ecf0ac8f8c8e9f8d601cc13cc7dfb246650bfd4ff8fdb3
Opcode Fuzzy Hash: 2c24119f787965044d627fb85e1f935b4d689670476c95a23688f33a408cf2b4
Instruction Fuzzy Hash: 9DD06711B09A0A82EA54FB7158E527893519F48F41F90143AC90E9A7A3DD3DA44D4322

Function 00007FF7E5D6E7E4 Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D6E828
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D6E91F

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6bf03d38dba950430044e224e6de6b096b3435415f1f736879eee21a3c0d5c6e
Instruction ID: 36e9fc17dbc5c8a8a14236c195034bd1519fd7f3e2a804523b7263f780c0c2d8
Opcode Fuzzy Hash: 6bf03d38dba950430044e224e6de6b096b3435415f1f736879eee21a3c0d5c6e
Instruction Fuzzy Hash: 4C511B61A09A4985FA64EA25D4A077BE395FF84FA4F844733DD6C873C5CE7CE4028623

Function 00007FF7E5D6B34C Relevance: 3.1, APIs: 2, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5D6B52C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7E5D6B540

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7E5D6B375
__scrt_release_startup_lock.LIBCMT ref: 00007FF7E5D6B3E3

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 1236291503-0
Opcode ID: 59deef07c40312847f55d6def9df2cc1f37e1ab7e24cf60098a74783f5463ac3
Instruction ID: bb06c77d0b068aae47c222dec58b1ee92c332d2b7d1ebfd99fb31e2d717bf95d
Opcode Fuzzy Hash: 59deef07c40312847f55d6def9df2cc1f37e1ab7e24cf60098a74783f5463ac3
Instruction Fuzzy Hash: 84310C21A0890A41FA10FB6594F13B99391AF45F84FC40237EA0DCB697DEBDE4068733

Function 00007FF7E5D7C51C Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7E5D7C595
GetFileType.KERNELBASE ref: 00007FF7E5D7C5AB

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 3071b830118634cb40028611ceeffb06fc3458eceab3432db34a7b9b2b67f05b
Instruction ID: 20d7e1fcdb42c568aebb9b76a4652e811f424277b428323c85735526b3a6bfc8
Opcode Fuzzy Hash: 3071b830118634cb40028611ceeffb06fc3458eceab3432db34a7b9b2b67f05b
Instruction Fuzzy Hash: B8318622A18B4A85DB64DB1495E4278A750FB45FB0BA4133ADB6F973F0CF39E461C312

Function 00007FF7E5D7AB70 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF7E5D7A9ED,?,?,00000000,00007FF7E5D7AAA2), ref: 00007FF7E5D7ABDE
GetLastError.KERNEL32(?,?,?,00007FF7E5D7A9ED,?,?,00000000,00007FF7E5D7AAA2), ref: 00007FF7E5D7ABE8

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 8421e8a4af99ada878c6549736f5471f2f7f62c165e76de116515189c6a53e17
Instruction ID: bb38d8d9627652b323903c953e6964eb6a845ee33388cb88f18b2e7f4fc491c5
Opcode Fuzzy Hash: 8421e8a4af99ada878c6549736f5471f2f7f62c165e76de116515189c6a53e17
Instruction Fuzzy Hash: 75218021B1864A41EE50F71595E03BD93829F44FA0F884277EA1FC63D6DE7CA4408322

Function 00007FF7E5D7C238 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7E5D7C224,?,?,?,00000000,?,00007FF7E5D7C32D), ref: 00007FF7E5D7C284
GetLastError.KERNEL32(?,?,?,?,?,00007FF7E5D7C224,?,?,?,00000000,?,00007FF7E5D7C32D), ref: 00007FF7E5D7C28E

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7c3c9af7b0c3ba882c1d4f7bd1684166dd02ec46220af4d411bd6b8cca88beee
Instruction ID: ab790ea5212036ddf3ff685b11882b1f518d11cc284b7d035df233ff9b72e31b
Opcode Fuzzy Hash: 7c3c9af7b0c3ba882c1d4f7bd1684166dd02ec46220af4d411bd6b8cca88beee
Instruction Fuzzy Hash: 12110421708B4585DA10EB65A890269B361AB45FF0F944332EF7E8B7F9CE3CD0548301

Function 00007FF7E5D759F0 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E5D75905), ref: 00007FF7E5D75A23
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E5D75905), ref: 00007FF7E5D75A39

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 24756dbb2e9daa31db72e7dcf0b088d8d1bf88fd8db7438d69b0fd56222304ee
Instruction ID: 88a2b113beec132d9060e1ae12630e8ecbdceb0f929e1016bbaa4f34e4db20fb
Opcode Fuzzy Hash: 24756dbb2e9daa31db72e7dcf0b088d8d1bf88fd8db7438d69b0fd56222304ee
Instruction Fuzzy Hash: 0B11C43160CA47C2EA50EB50A4A123BF3A0FB80B64F900237E69DC59E4EF7CE014CB11

Function 00007FF7E5D7A574 Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7E5D830B2,?,?,?,00007FF7E5D830EF,?,?,00000000,00007FF7E5D835B5,?,?,?,00007FF7E5D834E7), ref: 00007FF7E5D7A58A
GetLastError.KERNEL32(?,?,?,00007FF7E5D830B2,?,?,?,00007FF7E5D830EF,?,?,00000000,00007FF7E5D835B5,?,?,?,00007FF7E5D834E7), ref: 00007FF7E5D7A594

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 092f6e47d3cc2889ea351a036a35bb30039a98c0d818eb03a693ca50e7a47cf5
Instruction ID: 55c12baa7988cbe376c8cc0ed5b8ea5e8a084ecf60dc306298a29ecf506dc68f
Opcode Fuzzy Hash: 092f6e47d3cc2889ea351a036a35bb30039a98c0d818eb03a693ca50e7a47cf5
Instruction Fuzzy Hash: 22E0BF51F0950A86FA14FBB194E5275A7515F44F50FC44436DA0DCB2A6EE3C64458332

Function 00007FF7E5D7BFB0 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D7BFD8

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c44693da0f6aa4155cda53195200957f732adcd81b2643866b30557884f1ba75
Instruction ID: e649007bf089f39f780ecdc6575de7680b3a64027ecc315f4919987ca4c2fc40
Opcode Fuzzy Hash: c44693da0f6aa4155cda53195200957f732adcd81b2643866b30557884f1ba75
Instruction Fuzzy Hash: 7F41A23290820947EA34EB19E5A0379F7A0EB55F84F900132E79EC7691DF7DE4428B62

Function 00007FF7E5D66920 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7E5D669CA

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 3d293fc62481c92273e3278902cb633a71502ffff1dd2a0829246746ba51dedf
Instruction ID: b44e74e4cdd5e6167fef009561d08621196f67ab34df33db47234438e10d1f6c
Opcode Fuzzy Hash: 3d293fc62481c92273e3278902cb633a71502ffff1dd2a0829246746ba51dedf
Instruction Fuzzy Hash: D321F515B08A9545FA10FB1264A03B6D655BF45FD4FCC5132DD0CCB786CEBCE002C211

Function 00007FF7E5D7BA40 Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D7BAC6

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf7c005c1e31e7ea229f5223e293a291a449fd9923c8bf07186dd3c48721cc09
Instruction ID: 060e359b53ea74a89029151b7caba7d62548b4faa1025cee738e813131d9a72e
Opcode Fuzzy Hash: cf7c005c1e31e7ea229f5223e293a291a449fd9923c8bf07186dd3c48721cc09
Instruction Fuzzy Hash: 4B314B31A18A1A85F651FB15C8E137DA7A0AB84F95FC10137E95D833D2EEBCE4418732

Function 00007FF7E5D799B1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7E5D799DF

Part of subcall function 00007FF7E5D79AD8: GetModuleHandleExW.KERNEL32 ref: 00007FF7E5D79AFD
Part of subcall function 00007FF7E5D79AD8: GetProcAddress.KERNEL32 ref: 00007FF7E5D79B13
Part of subcall function 00007FF7E5D79AD8: FreeLibrary.KERNEL32 ref: 00007FF7E5D79B3A

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 7cdee7fffdefcbc5027b0452851aa9c5becd2890f0ec4c7d98fb6386710e4df3
Instruction ID: 53dd3645560323c07f38c5bbd90eef94d996653e450535415b903c7754004667
Opcode Fuzzy Hash: 7cdee7fffdefcbc5027b0452851aa9c5becd2890f0ec4c7d98fb6386710e4df3
Instruction Fuzzy Hash: F521BC32E16A4A8AEB20EF64D0903FC33A0EB44B18F840636D71C86BC5DF38E544C761

Function 00007FF7E5D76064 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D75FC9

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0c710f33dd0e263908a6af9c5a326f17bec47833feda8bc3952fb7c3f2c9ef99
Instruction ID: acab20d629447e40b6fc36418a9e07e146ab3954db447a62e2800b8356d25f80
Opcode Fuzzy Hash: 0c710f33dd0e263908a6af9c5a326f17bec47833feda8bc3952fb7c3f2c9ef99
Instruction Fuzzy Hash: 26113B22A0864A82EA61FF51D4A037DE764AF85F84FD44436EB4CD7A96DF7CD4408723

Function 00007FF7E5D866E4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D86707

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 371a19b6cbb4e76029cb4c6dd0e3fb09161d29462ff652c7a237cc4efd58c973
Instruction ID: 5a16e5f50a988be2b83ceaa9f51f6c4cb6b1a99df5a56666b334ceedf7dc96f1
Opcode Fuzzy Hash: 371a19b6cbb4e76029cb4c6dd0e3fb09161d29462ff652c7a237cc4efd58c973
Instruction Fuzzy Hash: 99219532618A8586EB61EF28E490379B7A0EB94F64F944236E65DCB6D9DF3CD400CB11

Function 00007FF7E5D6EA64 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D6EAB8

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 94cde1b0722b00ce3a89043d06a8f6ad091ac7731aa2d118b4c7a57a40d7012b
Instruction ID: c437a6fe87a684590ccf9062512332648797e325ce58314c12a44863ab715e2a
Opcode Fuzzy Hash: 94cde1b0722b00ce3a89043d06a8f6ad091ac7731aa2d118b4c7a57a40d7012b
Instruction Fuzzy Hash: 4001E525A08B4941E900EB52985026AE7A5FF85FE0F884332EE6C97BD6DE7CD0028712

Function 00007FF7E5D7F014 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7E5D7B33A,?,?,?,00007FF7E5D7B5A1,?,?,?,?,00007FF7E5D7A4A2), ref: 00007FF7E5D7F069

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 13c3c22db1661b05f673f30e797758779fd860c56a628e09e4eda6517155e894
Instruction ID: 737d5c1b3346563be2c80bbc755e1083836b9c882698a49199e5b85e1f97f991
Opcode Fuzzy Hash: 13c3c22db1661b05f673f30e797758779fd860c56a628e09e4eda6517155e894
Instruction Fuzzy Hash: D3F0F954B0960F81FE64F7A199A13B597955F99F90F888436890ECA3D2EE3CE5C18232

Function 00007FF7E5D7D8D4 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF7E5D7D83D,?,?,?,00007FF7E5D7130F), ref: 00007FF7E5D7D912

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ed43cc8fef10e4de0f6b38702312381f943abf623902b3a88b5f27f9598a1dfd
Instruction ID: f33393a323d1d32bed2dea43ef79e6a35a63c48db595b0586744881d5e4690c1
Opcode Fuzzy Hash: ed43cc8fef10e4de0f6b38702312381f943abf623902b3a88b5f27f9598a1dfd
Instruction Fuzzy Hash: 7DF0D411A0D20E81FE54BBA158A137593845F48FA0FC84632DA2FCA2D2EF3CA4808232

Function 00007FF7E5D6B52C Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7E5D6B540

Part of subcall function 00007FF7E5D6BF68: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF7E5D6BF70
Part of subcall function 00007FF7E5D6BF68: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF7E5D6BF75

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 42f905f2e02464d1f18fe0bfc90ee21d32569e03344996040c3241f949aa798e
Instruction ID: 4a1ba82924cbf903f4ed39b5ecf66fb5eb69ddb59fdb2b815cc36457744e5213
Opcode Fuzzy Hash: 42f905f2e02464d1f18fe0bfc90ee21d32569e03344996040c3241f949aa798e
Instruction Fuzzy Hash: E8E07E70D09A4B85FE64B66115F23F982401F21B04EC412BBE84DC61A3ADAEA4471633

Non-executed Functions

Function 00007FF7E5D64300 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7E5D64ED7,?,00007FF7E5D6224E), ref: 00007FF7E5D64310
GetProcAddress.KERNEL32(?,00007FF7E5D64ED7,?,00007FF7E5D6224E), ref: 00007FF7E5D64351
GetProcAddress.KERNEL32(?,00007FF7E5D64ED7,?,00007FF7E5D6224E), ref: 00007FF7E5D64376
GetProcAddress.KERNEL32(?,00007FF7E5D64ED7,?,00007FF7E5D6224E), ref: 00007FF7E5D6439B
GetProcAddress.KERNEL32(?,00007FF7E5D64ED7,?,00007FF7E5D6224E), ref: 00007FF7E5D643C3
GetProcAddress.KERNEL32(?,00007FF7E5D64ED7,?,00007FF7E5D6224E), ref: 00007FF7E5D643EB
GetProcAddress.KERNEL32(?,00007FF7E5D64ED7,?,00007FF7E5D6224E), ref: 00007FF7E5D64413
GetProcAddress.KERNEL32(?,00007FF7E5D64ED7,?,00007FF7E5D6224E), ref: 00007FF7E5D6443B
GetProcAddress.KERNEL32(?,00007FF7E5D64ED7,?,00007FF7E5D6224E), ref: 00007FF7E5D64463

Strings

PyImport_AddModule, xrefs: 00007FF7E5D64639, 00007FF7E5D64655
PyConfig_Read, xrefs: 00007FF7E5D64481, 00007FF7E5D6449D
PyUnicode_FromFormat, xrefs: 00007FF7E5D64959, 00007FF7E5D64975
PyConfig_SetWideStringList, xrefs: 00007FF7E5D644F9, 00007FF7E5D64515
PyErr_Restore, xrefs: 00007FF7E5D645E9, 00007FF7E5D64605
PyUnicode_DecodeFSDefault, xrefs: 00007FF7E5D64931, 00007FF7E5D6494D
PyMarshal_ReadObjectFromString, xrefs: 00007FF7E5D646D9, 00007FF7E5D646F5
PyObject_Str, xrefs: 00007FF7E5D647F1, 00007FF7E5D6480D
PyObject_SetAttrString, xrefs: 00007FF7E5D647C9, 00007FF7E5D647E5
Py_IsInitialized, xrefs: 00007FF7E5D643E1, 00007FF7E5D643FD
GetProcAddress, xrefs: 00007FF7E5D64330
PyErr_Fetch, xrefs: 00007FF7E5D64549, 00007FF7E5D64565
PyImport_ExecCodeModule, xrefs: 00007FF7E5D64661, 00007FF7E5D6467D
Py_DecRef, xrefs: 00007FF7E5D64306, 00007FF7E5D64322
PyUnicode_FromString, xrefs: 00007FF7E5D64981, 00007FF7E5D6499D
PyImport_ImportModule, xrefs: 00007FF7E5D64689, 00007FF7E5D646A5
Py_DecodeLocale, xrefs: 00007FF7E5D64347, 00007FF7E5D64363
PySys_SetObject, xrefs: 00007FF7E5D648B9, 00007FF7E5D648D5
PyRun_SimpleStringFlags, xrefs: 00007FF7E5D64841, 00007FF7E5D6485D
PyConfig_SetBytesString, xrefs: 00007FF7E5D644A9, 00007FF7E5D644C5
Py_ExitStatusException, xrefs: 00007FF7E5D6436C, 00007FF7E5D64388
PyMem_RawFree, xrefs: 00007FF7E5D64701, 00007FF7E5D6471D
PyErr_Occurred, xrefs: 00007FF7E5D64599, 00007FF7E5D645B5
PyObject_CallFunction, xrefs: 00007FF7E5D64751, 00007FF7E5D6476D
PyObject_GetAttrString, xrefs: 00007FF7E5D647A1, 00007FF7E5D647BD
PyErr_Clear, xrefs: 00007FF7E5D64521, 00007FF7E5D6453D
PyUnicode_AsUTF8, xrefs: 00007FF7E5D648E1, 00007FF7E5D648FD
PyConfig_SetString, xrefs: 00007FF7E5D644D1, 00007FF7E5D644ED
Py_PreInitialize, xrefs: 00007FF7E5D64409, 00007FF7E5D64425
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7E5D64819, 00007FF7E5D64835
PyModule_GetDict, xrefs: 00007FF7E5D64729, 00007FF7E5D64745
PyEval_EvalCode, xrefs: 00007FF7E5D64611, 00007FF7E5D6462D
PyConfig_Clear, xrefs: 00007FF7E5D64431, 00007FF7E5D6444D
PyUnicode_Join, xrefs: 00007FF7E5D649A9, 00007FF7E5D649C5
PyObject_CallFunctionObjArgs, xrefs: 00007FF7E5D64779, 00007FF7E5D64795
PyStatus_Exception, xrefs: 00007FF7E5D64869, 00007FF7E5D64885
PyErr_NormalizeException, xrefs: 00007FF7E5D64571, 00007FF7E5D6458D
PyConfig_InitIsolatedConfig, xrefs: 00007FF7E5D64459, 00007FF7E5D64475
Py_Finalize, xrefs: 00007FF7E5D64391, 00007FF7E5D643AD
PySys_GetObject, xrefs: 00007FF7E5D64891, 00007FF7E5D648AD
PyUnicode_Replace, xrefs: 00007FF7E5D649D1, 00007FF7E5D649ED
PyUnicode_Decode, xrefs: 00007FF7E5D64909, 00007FF7E5D64925
PyErr_Print, xrefs: 00007FF7E5D645C1, 00007FF7E5D645DD
PyList_Append, xrefs: 00007FF7E5D646B1, 00007FF7E5D646CD
Failed to get address for %hs, xrefs: 00007FF7E5D64329
Py_InitializeFromConfig, xrefs: 00007FF7E5D643B9, 00007FF7E5D643D5

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-2007157414
Opcode ID: 6c7de37b86274fb3d1d716974229e230ccf8eb543657595b6ff3dc3a011d8de1
Instruction ID: cac3ca8c92ed0bdc7954ea6bc9d26d08836625cdb988641f1c4de4fed5f15098
Opcode Fuzzy Hash: 6c7de37b86274fb3d1d716974229e230ccf8eb543657595b6ff3dc3a011d8de1
Instruction Fuzzy Hash: AB129764A49F4BD0EA56FB04B8F07B5A3A0AF05F55BD41137C50DDA3A0EF7CB5498222

Function 00007FF7E5D8443C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7E5D8448A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D84AF6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D84C6C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D84F2A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D8514A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D85387
memcpy_s.LIBCPMT ref: 00007FF7E5D85462
memcpy_s.LIBCPMT ref: 00007FF7E5D8550D
memcpy_s.LIBCPMT ref: 00007FF7E5D855DC

Strings

1#SNAN, xrefs: 00007FF7E5D8459A
1#INF, xrefs: 00007FF7E5D845B3
1#IND, xrefs: 00007FF7E5D84577
1#QNAN, xrefs: 00007FF7E5D845A3

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 6a73d64f3957e79f4831cfdc60d77cefc3706dcd898f99a703ecbe0e680df747
Instruction ID: ab5b5e0187de61741674d93dd6dd12fe52f0e7b628ddd48816e595b550406628
Opcode Fuzzy Hash: 6a73d64f3957e79f4831cfdc60d77cefc3706dcd898f99a703ecbe0e680df747
Instruction Fuzzy Hash: 9EB2E972E1828A8BE765DF64D4907FDB7A1FB44B48FC05136DA0D9BA84DB38A900CB51

Function 00007FF7E5D693BD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid code lengths set, xrefs: 00007FF7E5D6953D
invalid literal/length code, xrefs: 00007FF7E5D69AF2
invalid literal/lengths set, xrefs: 00007FF7E5D69843
invalid distances set, xrefs: 00007FF7E5D698B0
invalid distance too far back, xrefs: 00007FF7E5D69D80
invalid distance code, xrefs: 00007FF7E5D69CC4
invalid bit length repeat, xrefs: 00007FF7E5D697A9
invalid code -- missing end-of-block, xrefs: 00007FF7E5D697D6
too many length or distance symbols, xrefs: 00007FF7E5D69556

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 19919c9233c94dbecffabbbafd0da1bd8fe3cdfb3e337fb472f57dc76b8b5787
Instruction ID: f70f20d7fdb2aad743a6fc800f85d54a9d461dd6f80d8aa93050794b5c7b08e2
Opcode Fuzzy Hash: 19919c9233c94dbecffabbbafd0da1bd8fe3cdfb3e337fb472f57dc76b8b5787
Instruction Fuzzy Hash: 6A523872A14AAA8BD754DF14C4A8B7D77E9FB44740F81423AE64AC3780DB7CD845CB12

Function 00007FF7E5D6B84C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7E5D6B868
RtlCaptureContext.KERNEL32 ref: 00007FF7E5D6B895
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E5D6B8AF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E5D6B8F0
IsDebuggerPresent.KERNEL32 ref: 00007FF7E5D6B944
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E5D6B961
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7E5D6B96C

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 9b54a456cca8644e9267c01a8084384299a419a9074f18b847f9bd6aac1e9b99
Instruction ID: 81bfd3e2ecce6f4272321eebf4f08c47330cb9357aa57b033ee5bf6c0eaa973a
Opcode Fuzzy Hash: 9b54a456cca8644e9267c01a8084384299a419a9074f18b847f9bd6aac1e9b99
Instruction Fuzzy Hash: FB313D72609B8586EB60DF61E8903EDB364FB84B44F84403ADB4D8BB94DF78D549C721

Function 00007FF7E5D7A668 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7E5D7A6E1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E5D7A6F9
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E5D7A734
IsDebuggerPresent.KERNEL32 ref: 00007FF7E5D7A76D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E5D7A777
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7E5D7A782

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 61c5fe9d8ddf1a91b68eaaf79b4512adc479ec4e583f3c08dd1815cc8eca3973
Instruction ID: 28d5d4f5b4bfc5ab0a85906a26aa8915ddd949afccecdfe8ce823db7b39f9dc9
Opcode Fuzzy Hash: 61c5fe9d8ddf1a91b68eaaf79b4512adc479ec4e583f3c08dd1815cc8eca3973
Instruction Fuzzy Hash: 11315136608B8585EB60DF25E8903ADB3A4FB88B54F940136EA8D87B54DF3CD545CB11

Function 00007FF7E5D81C04 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D81C50
FindFirstFileExW.KERNEL32 ref: 00007FF7E5D81D5A

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 68d9696b78b2b04cbfbbadcaa10e7e272669cffb8f398423c6303c310c021837
Instruction ID: 4a4edd60dd98b3a5424e670e07868fb30af66ce0f83bc3b3dcac8c222daf663b
Opcode Fuzzy Hash: 68d9696b78b2b04cbfbbadcaa10e7e272669cffb8f398423c6303c310c021837
Instruction Fuzzy Hash: 1AB1C422B186DA41EA61EB61D4A03B9E3A1EB44FD4F845233EA4D8BB85DF3CE445C711

Function 00007FF7E5D61ED0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7E5D61EEC
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E5D625EE,?,00007FF7E5D626F4), ref: 00007FF7E5D61F56

Strings

<FormatMessageW failed.>, xrefs: 00007FF7E5D61F5C
%ls: %ls, xrefs: 00007FF7E5D61F76

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID: %ls: %ls$<FormatMessageW failed.>
API String ID: 3479602957-1483686772
Opcode ID: dfb41b6bca575f417ea75a48261e7533a71cf37c967872dfe92092f08ec333e5
Instruction ID: 93ae955de7e5d7456f6d38dac7ffa35f71c701bc495c319cf175241e540c20a9
Opcode Fuzzy Hash: dfb41b6bca575f417ea75a48261e7533a71cf37c967872dfe92092f08ec333e5
Instruction Fuzzy Hash: A711E372B08B8581F710EB11B890BA6A750BB88BC5F840136EF8D8BB69DF7CD5458752

Function 00007FF7E5D6B730 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7E5D6B75C
GetCurrentThreadId.KERNEL32 ref: 00007FF7E5D6B76A
GetCurrentProcessId.KERNEL32 ref: 00007FF7E5D6B776
QueryPerformanceCounter.KERNEL32 ref: 00007FF7E5D6B786

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 8a4a7c5325b633a925f5c4d5ed43519da64e7124304d0c27a96c3dbccc833fe3
Instruction ID: 2571add4a5eaaf08e05ca1e137b0927d87ccf336eb2b72d3fc8fbb70bfb9cd16
Opcode Fuzzy Hash: 8a4a7c5325b633a925f5c4d5ed43519da64e7124304d0c27a96c3dbccc833fe3
Instruction Fuzzy Hash: 1D113322B15F0689FB00DF64E8943B873A4FB19B58F440E36DA5D867A4DF7CD1948351

Function 00007FF7E5D83FA0 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7E5D84006
memcpy_s.LIBCPMT ref: 00007FF7E5D84031

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 422629a0a66608faecb1b8feaf85eafdccd09b53e0dff62441c058bb79f88bf9
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 2EC12672B1928A87E725DF59A09476EF791F794B88F809136DB4A8B744DB3CF800CB00

Function 00007FF7E5D68B8B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7E5D68C6B
header crc mismatch, xrefs: 00007FF7E5D69031
unknown header flags set, xrefs: 00007FF7E5D68BD5

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: ec936d166140e8da51e643a4531226a3b40fe54f705dd7d388a52184c5939a5f
Instruction ID: 82d6b06001c1e386de0602ccc92deb2ecbc8bc6f2957390db9bbb771342accda
Opcode Fuzzy Hash: ec936d166140e8da51e643a4531226a3b40fe54f705dd7d388a52184c5939a5f
Instruction Fuzzy Hash: C0F1E872A047C94BE791DB14C0E8B3EBAE9FF44B40F854636EA4987391CBB8D452C752

Function 00007FF7E5D89AB8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7E5D89D07
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E5D626F4), ref: 00007FF7E5D89D18

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 592aaa1d1e24c0ca7062a383ac7c08c3456e3625a81473f514852d4ab39e7f2b
Instruction ID: 6582253ef62a9bdda49db1e0966aee319ee67d23e53d500b656b766a47e659fd
Opcode Fuzzy Hash: 592aaa1d1e24c0ca7062a383ac7c08c3456e3625a81473f514852d4ab39e7f2b
Instruction Fuzzy Hash: E9B17D73600B888BEB15DF29C8963687BE0F744F88F588932DA9D8B7A4CB39D451C711

Function 00007FF7E5D735A0 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7E5D7370E
, xrefs: 00007FF7E5D73950

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 4206eb6757f2f30fe17398c19963b784f783257c512c01761c64f214e9c1497b
Instruction ID: 390ac77330a2e9cd98f5bf79c1794a9bd95638ef8c56d651bfe9572a32cd0e71
Opcode Fuzzy Hash: 4206eb6757f2f30fe17398c19963b784f783257c512c01761c64f214e9c1497b
Instruction Fuzzy Hash: 03E1CB72A0864A82EB68EE2580E033DB360FF45F48F945237DA4E87794DF39D861C752

Function 00007FF7E5D689EB Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF7E5D68B72
invalid window size, xrefs: 00007FF7E5D68B59

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 2ace5609b525119006861535f088e36343376fe54f431f018f35809291a9f140
Instruction ID: b968d87ae76f26de95529326de8a453ece7b766ad9aec8ccac924a7e6153822e
Opcode Fuzzy Hash: 2ace5609b525119006861535f088e36343376fe54f431f018f35809291a9f140
Instruction Fuzzy Hash: 8C91FC72A086CA87E7A4DF14C4E8B7E7BE9FB44750F41423ADA4A867C4CB78D541CB12

Function 00007FF7E5D7E1C8 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF7E5D7E352
e+000, xrefs: 00007FF7E5D7E2D5

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 1a606224f95ff019e49c69da0b246c648176fccdedc8a9ba9f88329446dd12d1
Instruction ID: a14242114da64e8656a5832a3147df1f6542293693dcbde3644163e34145f792
Opcode Fuzzy Hash: 1a606224f95ff019e49c69da0b246c648176fccdedc8a9ba9f88329446dd12d1
Instruction Fuzzy Hash: 3C515B22B186D986E724DA3598A176DBB95E744F94F888233CB9C8BAC1CF3DD4448712

Function 00007FF7E5D80C58 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: d0fb9989b67aa541942f54bb816287c7d54de0d91e0301e43054967d9c7987fc
Instruction ID: 4a1959cfb7f93158633cd4bfd7c237aea4ec3a3e8529eae157ee38cb12725326
Opcode Fuzzy Hash: d0fb9989b67aa541942f54bb816287c7d54de0d91e0301e43054967d9c7987fc
Instruction Fuzzy Hash: 6E028022A0D68E80FE51FB5198A1379A690AF41FA0FC44637ED5DCE7D2DE3CE4058322

Function 00007FF7E5D7DD34 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7E5D7E076

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 941045972006b9d0f1b3cc48f5e6a6d4cb79917f60820071d235da011363fb5d
Instruction ID: 64bb32fca9525f18d48530bd172c1ee441b1e95b30f87337bda5133a2f141aa1
Opcode Fuzzy Hash: 941045972006b9d0f1b3cc48f5e6a6d4cb79917f60820071d235da011363fb5d
Instruction Fuzzy Hash: FBA15862B087CA87EB21EF25A0A07A9FB95EB50F84F448132DE9D87785DE3DD501C712

Function 00007FF7E5D787E8 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7E5D78807

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 63fbde5e6ac14910810537c58a37d506e670242249e961798800c3dd729a4cd2
Instruction ID: 309f060513d8db8f09297e38777d580af0a3212026a41ca32ca53de29fdc7c1b
Opcode Fuzzy Hash: 63fbde5e6ac14910810537c58a37d506e670242249e961798800c3dd729a4cd2
Instruction Fuzzy Hash: C3518D01F0864A81FA68FA2659A137AD3906F84FC4FC84537DE1DC7796EE3CE4654223

Function 00007FF7E5D83810 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7E5D83814

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 9789172150413948e0b28418eec1c8a8ccf4190bb03978cfddeadbc209c5a328
Instruction ID: adfc361a46b2db96cd2e153fdbaaae564d1ed30c444f3d541388b37d1f9943ad
Opcode Fuzzy Hash: 9789172150413948e0b28418eec1c8a8ccf4190bb03978cfddeadbc209c5a328
Instruction Fuzzy Hash: 36B09224E0BA0AC2EA08BB116CD231462A4BF48F00FD4403AC20CC5330EE3C20A6D722

Function 00007FF7E5D730DC Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2358e72589b6b3377ab2bad04af7216ee3f8f759d040d1f797c8fb69fb0f14ee
Instruction ID: 471dc40af5cbde52356d51812bdd5eb0be42d53dd86fd97215f482ee77ce67e1
Opcode Fuzzy Hash: 2358e72589b6b3377ab2bad04af7216ee3f8f759d040d1f797c8fb69fb0f14ee
Instruction Fuzzy Hash: DAE1C526A0824A42EB69EA25C1E033DA7A1FF45F48F944137CE0D877D5CF39E865C362

Function 00007FF7E5D728A0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7343539c04ac9af6cdeac4bc6219f2c589e776346b6eb75cb976f653d0c459b
Instruction ID: 6658a4fdd3b534747b5e92fb4fd77e4a7abc36c373a0cf444b07052a3d0a02bf
Opcode Fuzzy Hash: a7343539c04ac9af6cdeac4bc6219f2c589e776346b6eb75cb976f653d0c459b
Instruction Fuzzy Hash: 99E1E832A0868A85E764EA28C1E537DA791EB45F44FD84237CE0DC76D9CFB8D841C322

Function 00007FF7E5D72CD8 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cca83ff74b263ce5c295529228f557388dca03720ded2e523bfa844f5f5f9ddc
Instruction ID: 10d46692dd6aa590f8618c0839da39b25c8af905ec564bd73c93dbd65cf639cf
Opcode Fuzzy Hash: cca83ff74b263ce5c295529228f557388dca03720ded2e523bfa844f5f5f9ddc
Instruction Fuzzy Hash: 9BD1F722A0868A85EB69EE2584B037DA7A0EF05F48F941237CE0D877D5CF7DD951C362

Function 00007FF7E5D67F10 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109faad2390431b91b5756b2411542da641bcf6ba28d728522257e2b87dbd1f6
Instruction ID: 7ae8491fe824f177c1d717c2a0093a4c5938f3a3e94f2e7f7f8b021edaff6a6a
Opcode Fuzzy Hash: 109faad2390431b91b5756b2411542da641bcf6ba28d728522257e2b87dbd1f6
Instruction Fuzzy Hash: 55C1F7722181F24BD289EB29E46947A73E0F798349BC4413AEB8747FC5C63CE015D7A1

Function 00007FF7E5D71570 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec59dfd8bcd7bcec265e8b5b2cbfbb381f6a605a6ab24caa1a9331ef77a952b4
Instruction ID: e2ca72d09cbc4fd44e6ca89e60b41167dc7005219397b936a8b1d0c656cdcb68
Opcode Fuzzy Hash: ec59dfd8bcd7bcec265e8b5b2cbfbb381f6a605a6ab24caa1a9331ef77a952b4
Instruction Fuzzy Hash: CFB1AE72A0865985E764EFB9C0A033CBBA0EB45F48F984336CA4D87399CF39D440C766

Function 00007FF7E5D71908 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c6a950e7996a4960caf206d6760023a42f3c60125d50f0e74594167b1f1f849
Instruction ID: f9258cbdd8379d91fa2caf95d84bae98bb25817ca0a3067581076997e76e93fb
Opcode Fuzzy Hash: 5c6a950e7996a4960caf206d6760023a42f3c60125d50f0e74594167b1f1f849
Instruction Fuzzy Hash: 6DB17F72A08B4985E765DF79C0A033DBBA0E746F48FA40236CA4E87395DF39D442C762

Function 00007FF7E5D7E848 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7110a39ce98c36f7cd450fec5ec8b7d5e4d2d3d1afbc802f151aa1d1f40819fd
Instruction ID: f41502e8cdbc628729c6aea8e1dda74f63398c789ed8aa5f836ca91452bdf6bd
Opcode Fuzzy Hash: 7110a39ce98c36f7cd450fec5ec8b7d5e4d2d3d1afbc802f151aa1d1f40819fd
Instruction Fuzzy Hash: AA811C72A0878585EB74DB25D4D0379FB95FB85B94F944236DA8D83B95CF3CE4008B12

Function 00007FF7E5D867A8 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 76841ffac59fb1aa117661ef60ddab495c3918d3b22b784fc25b9aee43533823
Instruction ID: 493db845784c5f8b95d86a44b17947dc61b299142d699b3f716873322f568c9d
Opcode Fuzzy Hash: 76841ffac59fb1aa117661ef60ddab495c3918d3b22b784fc25b9aee43533823
Instruction Fuzzy Hash: DF61EC22E0829686F764FA28A4A4739D690EF60B70F954237D66DCE6D0DE3DD840C723

Function 00007FF7E5D7088C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: fee257968afaef22215046f75f6af1e8f67ce80df3444eb4ed623fb60378d6be
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 40518876A14A5DC5E724DB29C0A0328B3A0EB54F58F688132CE4D977D5DB3AE843CB91

Function 00007FF7E5D7006C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: cd388d7a1c04a2ea3fef57b290f8d9120f4fcaf5f4929e462a493d098fba5f68
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 0951B532A1565D82E724DB29C0A032CB7A0EB45F68FA48136CE4C977D4DB3AE853CB51

Function 00007FF7E5D7047C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: e1aabebd8b9883a3ac181611335bd5643448a6228b5dabf9b8b2777493324996
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 36517276A1865DC6E724DB29C0A0738B3A0EB48F6CF645132CA4D977D4CB3AE853CB51

Function 00007FF7E5D70688 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7710b6301a9c53c0f35ccf6fc131232db227f89fb6367f1206a3fe51f4b04988
Instruction ID: cfce39edbb018aa2a23fe31046c01ad984895520d66ed02bedefed91f1f598f3
Opcode Fuzzy Hash: 7710b6301a9c53c0f35ccf6fc131232db227f89fb6367f1206a3fe51f4b04988
Instruction Fuzzy Hash: 8A518936A1865D86E724DB29C0A433DB7A0EB44F58FA44132CE4D977D4CB3AE842CF91

Function 00007FF7E5D6FE68 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b300af1d1946d5df55db44b3d4e0876ae34829a82d49cb6751e26c04e9c1898
Instruction ID: 003c1d2d805c86edcf61db0a84bd0b6318dc426ce282199c93145c742740e6d1
Opcode Fuzzy Hash: 3b300af1d1946d5df55db44b3d4e0876ae34829a82d49cb6751e26c04e9c1898
Instruction Fuzzy Hash: 1F51DB32A18E5B81E724DB28C0A0338B7A0EB45F58F645132DE4C87799DF7AE843C751

Function 00007FF7E5D70278 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9c7dfd85d7e05c9dc9b7e40d932aad9843605f203f1a6a08d3cc10701c718b
Instruction ID: 12bf447254bdfe09f3cae5a22b842509974877c1622b21ed5894adaf0b46defd
Opcode Fuzzy Hash: 7c9c7dfd85d7e05c9dc9b7e40d932aad9843605f203f1a6a08d3cc10701c718b
Instruction Fuzzy Hash: 91519537A1865D86E764DB29C0A4339A7A0EB48F5CFA44132CE4C977D5CB3AF842CB51

Function 00007FF7E5D75E00 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 9e8348ac103e60c69d7d924644db7c93cfa1f1243a9061f5f0dad298b37441ee
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 4B41EA62C09B8E4BE9A5D91805707B8D7809F23FA1DD852B3DDA9D73C7CE2C75468223

Function 00007FF7E5D79F30 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 0fd7490daaa7e0a19248f3b6b42aaed158052786efd0fd22baea32bbfaf7da08
Instruction ID: 54e1601a033de0a32df9d6c4c1be6d9237fb5e0169f526a1e3491a26fbf01a76
Opcode Fuzzy Hash: 0fd7490daaa7e0a19248f3b6b42aaed158052786efd0fd22baea32bbfaf7da08
Instruction Fuzzy Hash: C041D662714A5981EF04DF2AD9A42A9B3A1F748FD0B899437EE0DD7B58EE3DD0918301

Function 00007FF7E5D78130 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e05cbd369bc82755c7688a524d40d61e2cf24c17920e9f0f0fb44d621de31d12
Instruction ID: 472e6e1c007d46a1204859753b143d512f5fa679a9d8f99f54f645fe9bd0a6ff
Opcode Fuzzy Hash: e05cbd369bc82755c7688a524d40d61e2cf24c17920e9f0f0fb44d621de31d12
Instruction Fuzzy Hash: 7631B432B09B4642E764EF25A49032EB795AF85FA0F54423AEE4D93B95DF3CD0118315

Function 00007FF7E5D89900 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b912212f63dff320ae1362ab515060f6369f9d57119dd874f3da221ba5ce9b38
Instruction ID: 6bb0b800a2471e968c16072b4757179c8df633c82ff0928520094e425af39f1c
Opcode Fuzzy Hash: b912212f63dff320ae1362ab515060f6369f9d57119dd874f3da221ba5ce9b38
Instruction Fuzzy Hash: 0FF06871B18295CADBA4DF69A45272AB7D0F708780F84803EE58DC3B04D63D9051CF15

Function 00007FF7E5D6B9F0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fbf2b8d2d826e568a869ab6bdb6ddabbcfa6ae68d1c00615c4c18dff71faf79
Instruction ID: 78942b6e273efbb388764a915a63feece600a78f3b09fb541bed71d765519450
Opcode Fuzzy Hash: 5fbf2b8d2d826e568a869ab6bdb6ddabbcfa6ae68d1c00615c4c18dff71faf79
Instruction Fuzzy Hash: F0A00125909C4ED0E654EF00A8E0230A320BB54B04BC00132D24E894A09EBCB4458322

Function 00007FF7E5D66120 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7E5D66137
GetProcAddress.KERNEL32 ref: 00007FF7E5D6617D
GetProcAddress.KERNEL32 ref: 00007FF7E5D661A2
GetProcAddress.KERNEL32 ref: 00007FF7E5D661C7
GetProcAddress.KERNEL32 ref: 00007FF7E5D661EF
GetProcAddress.KERNEL32 ref: 00007FF7E5D66217
GetProcAddress.KERNEL32 ref: 00007FF7E5D6623F
GetProcAddress.KERNEL32 ref: 00007FF7E5D66267
GetProcAddress.KERNEL32 ref: 00007FF7E5D6628F

Strings

Tcl_GetObjResult, xrefs: 00007FF7E5D6652D, 00007FF7E5D66549
Tcl_EvalEx, xrefs: 00007FF7E5D6657D, 00007FF7E5D66599
Tcl_CreateThread, xrefs: 00007FF7E5D6625D, 00007FF7E5D66279
Tcl_Finalize, xrefs: 00007FF7E5D661E5, 00007FF7E5D66201
GetProcAddress, xrefs: 00007FF7E5D66157
Tcl_MutexLock, xrefs: 00007FF7E5D662D5, 00007FF7E5D662F1
Tk_GetNumMainWindows, xrefs: 00007FF7E5D66645, 00007FF7E5D66661
Tcl_ThreadQueueEvent, xrefs: 00007FF7E5D663C5, 00007FF7E5D663E1
Tcl_JoinThread, xrefs: 00007FF7E5D662AD, 00007FF7E5D662C9
Tcl_FindExecutable, xrefs: 00007FF7E5D66198, 00007FF7E5D661B4
Tcl_MutexUnlock, xrefs: 00007FF7E5D662FD, 00007FF7E5D66319
Tcl_FinalizeThread, xrefs: 00007FF7E5D6620D, 00007FF7E5D66229
Tcl_SetVar2, xrefs: 00007FF7E5D6643D, 00007FF7E5D66459
Tcl_Free, xrefs: 00007FF7E5D665F5, 00007FF7E5D66611
Tcl_NewStringObj, xrefs: 00007FF7E5D664B5, 00007FF7E5D664D1
Tcl_CreateInterp, xrefs: 00007FF7E5D66173, 00007FF7E5D6618F
Tcl_CreateObjCommand, xrefs: 00007FF7E5D66465, 00007FF7E5D66481
Tcl_ThreadAlert, xrefs: 00007FF7E5D663ED, 00007FF7E5D66409
Tcl_ConditionNotify, xrefs: 00007FF7E5D66375, 00007FF7E5D66391
Tcl_DoOneEvent, xrefs: 00007FF7E5D661BD, 00007FF7E5D661D9
Tcl_Init, xrefs: 00007FF7E5D66130, 00007FF7E5D66149
Tcl_EvalObjv, xrefs: 00007FF7E5D665A5, 00007FF7E5D665C1
Tcl_GetString, xrefs: 00007FF7E5D6648D, 00007FF7E5D664A9
Tcl_ConditionWait, xrefs: 00007FF7E5D6639D, 00007FF7E5D663B9
Tcl_DeleteInterp, xrefs: 00007FF7E5D66235, 00007FF7E5D66251
Tcl_GetCurrentThread, xrefs: 00007FF7E5D66285, 00007FF7E5D662A1
Tk_Init, xrefs: 00007FF7E5D6661D, 00007FF7E5D66639
Tcl_GetVar2, xrefs: 00007FF7E5D66415, 00007FF7E5D66431
Tcl_ConditionFinalize, xrefs: 00007FF7E5D6634D, 00007FF7E5D66369
Tcl_MutexFinalize, xrefs: 00007FF7E5D66325, 00007FF7E5D66341
Tcl_EvalFile, xrefs: 00007FF7E5D66555, 00007FF7E5D66571
Tcl_SetVar2Ex, xrefs: 00007FF7E5D66505, 00007FF7E5D66521
Failed to get address for %hs, xrefs: 00007FF7E5D66150
Tcl_Alloc, xrefs: 00007FF7E5D665CD, 00007FF7E5D665E9
Tcl_NewByteArrayObj, xrefs: 00007FF7E5D664DD, 00007FF7E5D664F9

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-3427451314
Opcode ID: da50994291d5d7417a1c3587fda7f6ee83bafe1361d694791fd4061e6410b693
Instruction ID: 9928a16ac1358f40097a46c1b5594c8a5d32736230cfa8b5202f8cf756d44ebb
Opcode Fuzzy Hash: da50994291d5d7417a1c3587fda7f6ee83bafe1361d694791fd4061e6410b693
Instruction Fuzzy Hash: E1E1A3A090AF0B90FA15EB44B8A03B5E3A4AF05F49BD41537C80DDA365EFBCB545C762

Function 00007FF7E5D66A50 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5D67AA0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7E5D631F4,00000000,00007FF7E5D61905), ref: 00007FF7E5D67AD9

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7E5D66F77,?,00000000,FFFFFFFF,00007FF7E5D62AA6), ref: 00007FF7E5D66AAC

Strings

LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7E5D66A83
%.*s, xrefs: 00007FF7E5D66B8C
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7E5D66AC0
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7E5D66BED
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7E5D66B59
\, xrefs: 00007FF7E5D66AE1
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7E5D66B1D
CreateDirectory, xrefs: 00007FF7E5D66BF4

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 2001182103-930877121
Opcode ID: 575a631697603eb4a9eb36166bd6d4e279ab7f46c3e8e9ef1e3954877c5b476e
Instruction ID: 77c25eb6eac61b09f308acf47053e8f2b538acab2a8ba798bd5bc6870e99bd00
Opcode Fuzzy Hash: 575a631697603eb4a9eb36166bd6d4e279ab7f46c3e8e9ef1e3954877c5b476e
Instruction Fuzzy Hash: 04418F60A18A4A81FA50F724D4F17BAE351EF84F80FC44533E60EC6696EE7CE545C762

Function 00007FF7E5D76360 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D763A3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D76790
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D76A2C

Strings

:, xrefs: 00007FF7E5D7655C
-, xrefs: 00007FF7E5D76439
p, xrefs: 00007FF7E5D764CD
p, xrefs: 00007FF7E5D76455
f, xrefs: 00007FF7E5D764C5

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 56519bff4440c9db1085a76ccf4a032d998a7c787b27cd0bdd7cdefd46c8a644
Instruction ID: dc2381043a5e10e529163f4d56e52645911275c6a3d3ad73ed436c89418cb6b2
Opcode Fuzzy Hash: 56519bff4440c9db1085a76ccf4a032d998a7c787b27cd0bdd7cdefd46c8a644
Instruction Fuzzy Hash: 7B127261E0815B86FB24FA15D1A47B9F791EB80F54FD84137D689C6AC4EB3CE580CB22

Function 00007FF7E5D6F6F0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D6F730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D6FAF8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D6FD97

Strings

f, xrefs: 00007FF7E5D6F97D
p, xrefs: 00007FF7E5D6F7D5
f, xrefs: 00007FF7E5D6F7C8
p, xrefs: 00007FF7E5D6F83A
f, xrefs: 00007FF7E5D6F832

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 2761c62bb11862c53203c4a1c44b9eb9fed40e0afa0247b40f2c3f0b102f2d4b
Instruction ID: 1e27e41da10cc4d62b4f2a9c2620be358810190c10872c4905bc5464d5fb94ea
Opcode Fuzzy Hash: 2761c62bb11862c53203c4a1c44b9eb9fed40e0afa0247b40f2c3f0b102f2d4b
Instruction Fuzzy Hash: 6C126462A08D4B85FB20FA14D0F43B9F651EB50B54FD44237D699866CCDEBCE5828B22

Function 00007FF7E5D61030 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF7E5D61077
fseek, xrefs: 00007FF7E5D610AC
malloc, xrefs: 00007FF7E5D610DC
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7E5D610D5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7E5D610A5
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7E5D611B0
fread, xrefs: 00007FF7E5D611B7

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: f39caea26cc73b71d0c15adbece88b9418682ee1559bcd835a771f2d1593829f
Instruction ID: 7b3e96b712207cb3c3c053879a0f1712e6c48ea46b3a6c1722f80ed9282ecda9
Opcode Fuzzy Hash: f39caea26cc73b71d0c15adbece88b9418682ee1559bcd835a771f2d1593829f
Instruction Fuzzy Hash: A141A721B08A4A81EA14FB55A9A07B6E351FF04FD4FC44233DE0D8B791DE7CE4468752

Function 00007FF7E5D61420 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF7E5D6144F
fseek, xrefs: 00007FF7E5D61490
malloc, xrefs: 00007FF7E5D614C0
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7E5D614B9
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7E5D61489
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7E5D6157A
fread, xrefs: 00007FF7E5D61581

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: c09fcfe999fef20416984afe8f6c252e160c56447ffe0a007e47058900a911af
Instruction ID: 7f618cc36fcf15e4feaecf71b6cbd78a1b9a007a339bda92ffc41a6e37164398
Opcode Fuzzy Hash: c09fcfe999fef20416984afe8f6c252e160c56447ffe0a007e47058900a911af
Instruction Fuzzy Hash: F041A621B0895A81EE20FB55A8A07B6E360EF04FD0FC44133DE4D8BB55EEBCE4468712

Function 00007FF7E5D6D0E8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7E5D6D145

Part of subcall function 00007FF7E5D6E09C: __GetUnwindTryBlock.LIBCMT ref: 00007FF7E5D6E0DF
Part of subcall function 00007FF7E5D6E09C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7E5D6E104

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7E5D6D21D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7E5D6D46B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7E5D6D578

Strings

csm, xrefs: 00007FF7E5D6D1C6
csm, xrefs: 00007FF7E5D6D15F
csm, xrefs: 00007FF7E5D6D240

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 0bc14b43f82724757755035e8bb788fa738e65321b17f9437cbf630de17fc83d
Instruction ID: 3b5aab9bba14ed9ce6e872aca22b9f923be6359148463b346ba52f0a93074983
Opcode Fuzzy Hash: 0bc14b43f82724757755035e8bb788fa738e65321b17f9437cbf630de17fc83d
Instruction Fuzzy Hash: 51D19632908B4586E720FB65E4903ADB7A0FB45B88F900236DE4DD7B55DF78E542C712

Function 00007FF7E5D6C3A8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7E5D6C65A,?,?,?,00007FF7E5D6C34C,?,?,?,00007FF7E5D6BF49), ref: 00007FF7E5D6C42D
GetLastError.KERNEL32(?,?,?,00007FF7E5D6C65A,?,?,?,00007FF7E5D6C34C,?,?,?,00007FF7E5D6BF49), ref: 00007FF7E5D6C43B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7E5D6C65A,?,?,?,00007FF7E5D6C34C,?,?,?,00007FF7E5D6BF49), ref: 00007FF7E5D6C465
FreeLibrary.KERNEL32(?,?,?,00007FF7E5D6C65A,?,?,?,00007FF7E5D6C34C,?,?,?,00007FF7E5D6BF49), ref: 00007FF7E5D6C4D3
GetProcAddress.KERNEL32(?,?,?,00007FF7E5D6C65A,?,?,?,00007FF7E5D6C34C,?,?,?,00007FF7E5D6BF49), ref: 00007FF7E5D6C4DF

Strings

api-ms-, xrefs: 00007FF7E5D6C44D

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 496a7ecf6f59d04b00b07dbc004f637d20d4b4784e39964ab918570cd1e35837
Instruction ID: d80721504a7c4b8f74b8db038ba7d19002f41c11576b2bae9d77836356fe1765
Opcode Fuzzy Hash: 496a7ecf6f59d04b00b07dbc004f637d20d4b4784e39964ab918570cd1e35837
Instruction Fuzzy Hash: 7C31A72170AE09C1EE11FB06A8A0775A394BF14FA4FD94636DE1D8B761EE7CF4458321

Function 00007FF7E5D7B160 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7E5D7B16F
FlsGetValue.KERNEL32 ref: 00007FF7E5D7B184
FlsSetValue.KERNEL32 ref: 00007FF7E5D7B1A5
FlsSetValue.KERNEL32 ref: 00007FF7E5D7B1D2
FlsSetValue.KERNEL32 ref: 00007FF7E5D7B1E3
FlsSetValue.KERNEL32 ref: 00007FF7E5D7B1F4
SetLastError.KERNEL32 ref: 00007FF7E5D7B20F

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 917d90d80928c6fc8378362abee88ed752e53442152e884b24a4914503779b53
Instruction ID: 2f8fd16bd93fff0decb9cbe525f563bd1985a683b1cd8779cddfd69cb5339d8d
Opcode Fuzzy Hash: 917d90d80928c6fc8378362abee88ed752e53442152e884b24a4914503779b53
Instruction Fuzzy Hash: A8213C20E0E24B41FA69F72596F1379D3529F44FA0F94463AE93EC66D6EE3CA4014722

Function 00007FF7E5D880FC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7E5D8812D
GetLastError.KERNEL32 ref: 00007FF7E5D88139
CloseHandle.KERNEL32 ref: 00007FF7E5D88151
CreateFileW.KERNEL32 ref: 00007FF7E5D8817C
WriteConsoleW.KERNEL32 ref: 00007FF7E5D8819B

Strings

CONOUT$, xrefs: 00007FF7E5D8815D

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 75dcc73177df9c890c20c0009d1351a96d786b6ac8a09940c58dca2f02eba5de
Instruction ID: cc6a38648772b5b10d99bb417cd907816a698e480a3c2aaeda12672573a0972b
Opcode Fuzzy Hash: 75dcc73177df9c890c20c0009d1351a96d786b6ac8a09940c58dca2f02eba5de
Instruction Fuzzy Hash: 8B118421618A4686E750DB46E8E4329A3A0FB88FE4F804236DA1DCB7A4CF7CE4548751

Function 00007FF7E5D674D0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,00007FF7E5D62C4F), ref: 00007FF7E5D674FD
K32EnumProcessModules.KERNEL32(?,00007FF7E5D62C4F), ref: 00007FF7E5D6755A

Part of subcall function 00007FF7E5D67AA0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7E5D631F4,00000000,00007FF7E5D61905), ref: 00007FF7E5D67AD9

K32GetModuleFileNameExW.KERNEL32(?,00007FF7E5D62C4F), ref: 00007FF7E5D675E5
K32GetModuleFileNameExW.KERNEL32(?,00007FF7E5D62C4F), ref: 00007FF7E5D67644
FreeLibrary.KERNEL32(?,00007FF7E5D62C4F), ref: 00007FF7E5D67655
FreeLibrary.KERNEL32(?,00007FF7E5D62C4F), ref: 00007FF7E5D6766A

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 03b7074d898f978953d4d1084a470d0e05b12668f520811b20350f06d8902ea3
Instruction ID: 9c631ef6ec399cc454d57ad1f4ed34365c818e0083dd5f6aa70fb399c2686eae
Opcode Fuzzy Hash: 03b7074d898f978953d4d1084a470d0e05b12668f520811b20350f06d8902ea3
Instruction Fuzzy Hash: 2C41EA71A19A8E81EA70EB55A5A03BAB390FB44FD0F844232DF4E97785DE7CD101C711

Function 00007FF7E5D7B2D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7E5D7B5A1,?,?,?,?,00007FF7E5D7A4A2,?,?,?,?,00007FF7E5D771DB), ref: 00007FF7E5D7B2E7
FlsSetValue.KERNEL32(?,?,?,00007FF7E5D7B5A1,?,?,?,?,00007FF7E5D7A4A2,?,?,?,?,00007FF7E5D771DB), ref: 00007FF7E5D7B31D
FlsSetValue.KERNEL32(?,?,?,00007FF7E5D7B5A1,?,?,?,?,00007FF7E5D7A4A2,?,?,?,?,00007FF7E5D771DB), ref: 00007FF7E5D7B34A
FlsSetValue.KERNEL32(?,?,?,00007FF7E5D7B5A1,?,?,?,?,00007FF7E5D7A4A2,?,?,?,?,00007FF7E5D771DB), ref: 00007FF7E5D7B35B
FlsSetValue.KERNEL32(?,?,?,00007FF7E5D7B5A1,?,?,?,?,00007FF7E5D7A4A2,?,?,?,?,00007FF7E5D771DB), ref: 00007FF7E5D7B36C
SetLastError.KERNEL32(?,?,?,00007FF7E5D7B5A1,?,?,?,?,00007FF7E5D7A4A2,?,?,?,?,00007FF7E5D771DB), ref: 00007FF7E5D7B387

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 8aacf979bcb0e66df657e62488df5adcc3b9183591c645a3a116bd618948e068
Instruction ID: 15c996b8d20f85cae69c9cef6ad17cdafdf434e1f5c716df17844014914d2728
Opcode Fuzzy Hash: 8aacf979bcb0e66df657e62488df5adcc3b9183591c645a3a116bd618948e068
Instruction Fuzzy Hash: 88112920A0D64B42FA64F72596F137D93529F44FA0FD4073BE92EC66D6EE3CA4414722

Function 00007FF7E5D79AD8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7E5D79AFD
GetProcAddress.KERNEL32 ref: 00007FF7E5D79B13
FreeLibrary.KERNEL32 ref: 00007FF7E5D79B3A

Strings

CorExitProcess, xrefs: 00007FF7E5D79B0C
mscoree.dll, xrefs: 00007FF7E5D79AF4

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 74180e4fa832d38856561e4d839db25a4cf7d44bb16d70be9d308bd11a404090
Instruction ID: 75dd2ff171dbbfadc439dd662783bf894b692d10c92126f7407e39a25d8616e1
Opcode Fuzzy Hash: 74180e4fa832d38856561e4d839db25a4cf7d44bb16d70be9d308bd11a404090
Instruction Fuzzy Hash: E8F04461A1860A81EA10EB24E4E5335A320EF48BA5F940236C66D891F4CF3CD4498721

Function 00007FF7E5D896F8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7E5D89720
_set_statfp.LIBCMT ref: 00007FF7E5D8973B
_set_statfp.LIBCMT ref: 00007FF7E5D89757
_set_statfp.LIBCMT ref: 00007FF7E5D89793

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 3a85bc7ca50dc343b0848c358f6251bc43df0cfdcc7452c4ce1eb19307b01e8d
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: A1119022E18E0F01F655BB65ECF537581406F95BA0E980636FAFE9E2D68E3C68414126

Function 00007FF7E5D7B3A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7E5D7A5F7,?,?,00000000,00007FF7E5D7A892,?,?,?,?,?,00007FF7E5D7A81E), ref: 00007FF7E5D7B3BF
FlsSetValue.KERNEL32(?,?,?,00007FF7E5D7A5F7,?,?,00000000,00007FF7E5D7A892,?,?,?,?,?,00007FF7E5D7A81E), ref: 00007FF7E5D7B3DE
FlsSetValue.KERNEL32(?,?,?,00007FF7E5D7A5F7,?,?,00000000,00007FF7E5D7A892,?,?,?,?,?,00007FF7E5D7A81E), ref: 00007FF7E5D7B406
FlsSetValue.KERNEL32(?,?,?,00007FF7E5D7A5F7,?,?,00000000,00007FF7E5D7A892,?,?,?,?,?,00007FF7E5D7A81E), ref: 00007FF7E5D7B417
FlsSetValue.KERNEL32(?,?,?,00007FF7E5D7A5F7,?,?,00000000,00007FF7E5D7A892,?,?,?,?,?,00007FF7E5D7A81E), ref: 00007FF7E5D7B428

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a56cb41f156c15a4d6e2276d4d9009eb056191f4cbd7c4a906779812fc23d362
Instruction ID: 62769482df93bba1e14db35402f5046dffc394b9c55ae95c45aebe3d76b44909
Opcode Fuzzy Hash: a56cb41f156c15a4d6e2276d4d9009eb056191f4cbd7c4a906779812fc23d362
Instruction Fuzzy Hash: FE115C20E0D24B41FA68F72595F1379A3529F44BA4FD4433AE83D966D6EE3CE4428722

Function 00007FF7E5D7B234 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7E5D7B245
FlsSetValue.KERNEL32 ref: 00007FF7E5D7B264
FlsSetValue.KERNEL32 ref: 00007FF7E5D7B28C
FlsSetValue.KERNEL32 ref: 00007FF7E5D7B29D
FlsSetValue.KERNEL32 ref: 00007FF7E5D7B2AE

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: c970022877af4cacafbb269055ba7698425e7e9d221925838a0931e6a0572288
Instruction ID: 6f16e6cb790f791bd758c645656146f94054efa10031420b0d4c4403b2cc60c2
Opcode Fuzzy Hash: c970022877af4cacafbb269055ba7698425e7e9d221925838a0931e6a0572288
Instruction Fuzzy Hash: D911C510E0E24F41F969F26594F13BE93424F45B60FD4073BE93E9A2D2ED7DB4414662

Function 00007FF7E5D76070 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D760AC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D761D6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D7628C

Strings

verbose, xrefs: 00007FF7E5D76080

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: d610ef641c588f277c108bde4856d5b42c6a1526a9b3408ef7dc71a8c1851c95
Instruction ID: ce9ce192ebaf85732940deec49351e24258119aa709fbfaab64868db896e605d
Opcode Fuzzy Hash: d610ef641c588f277c108bde4856d5b42c6a1526a9b3408ef7dc71a8c1851c95
Instruction Fuzzy Hash: 3491B122A09A4A85FB61EE25D4A03BDB7A1AB44F94FC44137DA59C63C5EF3CE445C322

Function 00007FF7E5D7FF58 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D80237

Part of subcall function 00007FF7E5D77A88: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D77AA5

Strings

UTF-16LEUNICODE, xrefs: 00007FF7E5D801D5
UTF-8, xrefs: 00007FF7E5D801B6
ccs, xrefs: 00007FF7E5D80172

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 2a6abe9d3ebc046f6c8623f50389ac56c58ca4fd7f9c577c93c606ec2c1639a6
Instruction ID: 727e26ff1a6651432cd99d06455e1319f79e7c1f92100c4d6037755feb5e7f13
Opcode Fuzzy Hash: 2a6abe9d3ebc046f6c8623f50389ac56c58ca4fd7f9c577c93c606ec2c1639a6
Instruction Fuzzy Hash: 7181A033E0924E85F775EE29C1A0378E6A0AB11F58FD59037DA09DB295DB3CB9419323

Function 00007FF7E5D6BD28 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7E5D6BD53
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7E5D6BDEA
RtlUnwindEx.KERNEL32 ref: 00007FF7E5D6BE44

Strings

csm, xrefs: 00007FF7E5D6BDD1

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 627e2886ea4909029de1e6aee41716b715171f1193883d49ddb7c83e540dd8b9
Instruction ID: 0d8e33d2579dcc4f851c1268d427bf28f2abdae4b41b7afda52366536d46a80d
Opcode Fuzzy Hash: 627e2886ea4909029de1e6aee41716b715171f1193883d49ddb7c83e540dd8b9
Instruction Fuzzy Hash: 8851D631B19A0A8AEB14EF15D4A4738B391EB44F88F844232DB4D87759DFBDE842C751

Function 00007FF7E5D6D5B8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7E5D6D617
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7E5D6D663

Strings

RCC, xrefs: 00007FF7E5D6D633
MOC, xrefs: 00007FF7E5D6D62B

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: cc3e5af3579310c0f15044b16b4c065b5d98d02129ef80afc6ac9937df3d6924
Instruction ID: ad7be3ae7e8bad3bc951d134824b596a22c84e58afbca982dc4c9e1e4cf588d0
Opcode Fuzzy Hash: cc3e5af3579310c0f15044b16b4c065b5d98d02129ef80afc6ac9937df3d6924
Instruction Fuzzy Hash: 9F618172908BC985D720EF15E4903AAB7A0FB98B84F444236EB9D47B55CFBCD191CB12

Function 00007FF7E5D6D968 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7E5D6D990
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7E5D6DA78

Strings

csm, xrefs: 00007FF7E5D6D9B2
csm, xrefs: 00007FF7E5D6DACA

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: c0a76f74c02f5f9c08219b48ec89f4fd38640c03acd471a6f2cd3cbd44defde3
Instruction ID: f8e6a7f5096d9e6e0976d53cb25bfe537a806a8a92ba6692a41362701ed119de
Opcode Fuzzy Hash: c0a76f74c02f5f9c08219b48ec89f4fd38640c03acd471a6f2cd3cbd44defde3
Instruction Fuzzy Hash: DD51D532508B4A8ADB30FF15A4A0368B7A0EB54F85F984237DA4C87799CF7CE452C712

Function 00007FF7E5D7C6B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7E5D7C72F
WriteFile.KERNEL32 ref: 00007FF7E5D7C9F7
WriteFile.KERNEL32 ref: 00007FF7E5D7CA3D
GetLastError.KERNEL32 ref: 00007FF7E5D7CAF3

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: abc0b2a711b36b4ca2ebf077ba9d6b71990bb933ff0a79b92d2fce847f8ec71f
Instruction ID: 4fbcb17f3b971647756d481c885d259806682d03f54548c886f28cdb680d5d17
Opcode Fuzzy Hash: abc0b2a711b36b4ca2ebf077ba9d6b71990bb933ff0a79b92d2fce847f8ec71f
Instruction Fuzzy Hash: 8FD1F472B18B898EE710DF69D4902AC77B1FB44B98B844236DF4D97BA9DE38D006C311

Function 00007FF7E5D676E0 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00007FF7E5D676E6
GetCurrentProcessId.KERNEL32 ref: 00007FF7E5D676F9
GetWindowThreadProcessId.USER32 ref: 00007FF7E5D67709
ShowWindow.USER32 ref: 00007FF7E5D6771E

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Window$Process$ConsoleCurrentShowThread
String ID:
API String ID: 242035731-0
Opcode ID: 3208cc31caa42c1873c1a6d21fea691fbaaade434fa387f7c55649933cf3fd9f
Instruction ID: cba0dabaa032b104d3b81c30dc37d3e3e95c9411324b84794d0ec89d53077ebc
Opcode Fuzzy Hash: 3208cc31caa42c1873c1a6d21fea691fbaaade434fa387f7c55649933cf3fd9f
Instruction Fuzzy Hash: C0F03E21A19B4AC1EB54E76674D42359291FF44FD0B481031D55F8B754DE3CE4458722

Function 00007FF7E5D67850 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00007FF7E5D67856
GetCurrentProcessId.KERNEL32 ref: 00007FF7E5D67869
GetWindowThreadProcessId.USER32 ref: 00007FF7E5D67879
ShowWindow.USER32 ref: 00007FF7E5D67891

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Window$Process$ConsoleCurrentShowThread
String ID:
API String ID: 242035731-0
Opcode ID: 57d29c8d12d7fdef30ff7322895d09215f545c1cd19415f77748bb3fa77fc87e
Instruction ID: 17acbbe63c775f3a30336fb51f66c658a90053156a0adf77fcc01720489df39c
Opcode Fuzzy Hash: 57d29c8d12d7fdef30ff7322895d09215f545c1cd19415f77748bb3fa77fc87e
Instruction Fuzzy Hash: 5CF08221A18A4AC2EA50AB25A890238A750EF94F94F441031DA0B8F654DE3CF442C722

Function 00007FF7E5D85EAC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5D81AF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D81B23

_get_daylight.LIBCMT ref: 00007FF7E5D85FC4
_get_daylight.LIBCMT ref: 00007FF7E5D85FD5

Strings

?, xrefs: 00007FF7E5D85F55

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 251138c72b5965edf1fa1f81af5a04797616578f3cc633bdfd53ce657dc71f87
Instruction ID: 4254c3ebeb6db0f40fa1f5389517b277350c12c89a3eb98a721856af8daf4465
Opcode Fuzzy Hash: 251138c72b5965edf1fa1f81af5a04797616578f3cc633bdfd53ce657dc71f87
Instruction Fuzzy Hash: D0412B12A0838A52FB21E725E4A177AD750EB90FA4F944236EE5C8BAD5DF3CD481C712

Function 00007FF7E5D79068 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D7909A

Part of subcall function 00007FF7E5D7A574: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7E5D830B2,?,?,?,00007FF7E5D830EF,?,?,00000000,00007FF7E5D835B5,?,?,?,00007FF7E5D834E7), ref: 00007FF7E5D7A58A
Part of subcall function 00007FF7E5D7A574: GetLastError.KERNEL32(?,?,?,00007FF7E5D830B2,?,?,?,00007FF7E5D830EF,?,?,00000000,00007FF7E5D835B5,?,?,?,00007FF7E5D834E7), ref: 00007FF7E5D7A594

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7E5D6B2B5), ref: 00007FF7E5D790B8

Strings

C:\Users\user\Desktop\LKEAHetlG6.exe, xrefs: 00007FF7E5D790A6

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\LKEAHetlG6.exe
API String ID: 2553983749-605488607
Opcode ID: 3df4ae63d4fff12831f189b335aa218eb560bdcda4609670a69b9ecc1ff23c91
Instruction ID: a361ce27f039bd10ec502171f0ff6e6aec4497ac87959e1d4a0b30e937b9ba34
Opcode Fuzzy Hash: 3df4ae63d4fff12831f189b335aa218eb560bdcda4609670a69b9ecc1ff23c91
Instruction Fuzzy Hash: 7C41A236A09B0A85EB14EF2194A02BDA7A4EB44FD4FC44037EE0E87B55DF3DE4518721

Function 00007FF7E5D80960 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D80996

Part of subcall function 00007FF7E5D7F948: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7E5D7F988

Strings

:, xrefs: 00007FF7E5D809D6
., xrefs: 00007FF7E5D809E7

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: CurrentDirectory_invalid_parameter_noinfo
String ID: .$:
API String ID: 2020911589-4202072812
Opcode ID: 9fdf0e15571f30b7c38997099fbb633568246911cf6993026fb6492d211a726f
Instruction ID: 7969906736d56280ab3b37638cee893fed003c68d880a7897a24aa24f97b5ab0
Opcode Fuzzy Hash: 9fdf0e15571f30b7c38997099fbb633568246911cf6993026fb6492d211a726f
Instruction Fuzzy Hash: 9B415123F0571A88FB11FBB1D8A13BC67B46F14B58F950036DE4DABA45EF7894418322

Function 00007FF7E5D7CD48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7E5D7CE5F
GetLastError.KERNEL32 ref: 00007FF7E5D7CE81

Strings

U, xrefs: 00007FF7E5D7CE0B

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 6764b710f0a65045100584de59578b99259699ae606962c210fa940051883c42
Instruction ID: fd404a74e14bb13a48334e67cef8659b27ebec66ced51a68f3276b080840785c
Opcode Fuzzy Hash: 6764b710f0a65045100584de59578b99259699ae606962c210fa940051883c42
Instruction Fuzzy Hash: 4B41C522B18A4986DB20DF25E4943A9B7A0FB88B94F804032EF4DC7798EF7CD541C711

Function 00007FF7E5D7F948 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7E5D7F988
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7E5D7F9DA

Strings

:, xrefs: 00007FF7E5D7F99E

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 9dec074b9d91ec7ae96ccd96e392c63e7b8b71e9f9fc28a933b8ea542cd4a31c
Instruction ID: 19b8fa0ecb52b00954fb2b78bcb06da1d65e82fe527de62ab86cb466a1e4bb1a
Opcode Fuzzy Hash: 9dec074b9d91ec7ae96ccd96e392c63e7b8b71e9f9fc28a933b8ea542cd4a31c
Instruction Fuzzy Hash: B421A522A0868A81EB30EB15D0A436DA3B1FB88F44FC54136D68D97685DF7CD945C762

Function 00007FF7E5D6E428 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7E5D6E478
RaiseException.KERNEL32 ref: 00007FF7E5D6E4B9

Strings

csm, xrefs: 00007FF7E5D6E4A6

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 3f05b1905f12a1bed12f21e0207e664c2b0ec1695d98dcac3f1d84e26f90b74b
Instruction ID: cc0a5e59170ad077bd97ead29d00122aaeaf62156e6523c0775883bd3655e171
Opcode Fuzzy Hash: 3f05b1905f12a1bed12f21e0207e664c2b0ec1695d98dcac3f1d84e26f90b74b
Instruction Fuzzy Hash: FA114C32618B4482EB20DB25F45035AB7E4FB88F94F984231DB8D4BB65DF3CD5528B01

Function 00007FF7E5D80ACC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D80AFC
GetDriveTypeW.KERNEL32 ref: 00007FF7E5D80B3C

Strings

:, xrefs: 00007FF7E5D80B25

Memory Dump Source

Source File: 00000000.00000002.2174982693.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000000.00000002.2174963713.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012260.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175035046.00007FF7E5DA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175070960.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 174772ca82d4c258b4559b3c63bfe56a5dca8de60d86d28929754780ce6d6ae2
Instruction ID: 624683cf922440fb7e73475d099a7d2d9946e735799e18bc7491d671db1546ab
Opcode Fuzzy Hash: 174772ca82d4c258b4559b3c63bfe56a5dca8de60d86d28929754780ce6d6ae2
Instruction Fuzzy Hash: 14017162A1820E86F720FF6094B637EA3A0EF44B49FC45537D54DCA691EE3CE544CA26

Analysis Process: LKEAHetlG6.exePID: 7152, Parent PID: 6340COMMON

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.2%
Total number of Nodes:	1496
Total number of Limit Nodes:	112

Executed Functions

Function 00007FF8B7FF1A0F Relevance: 149.6, APIs: 77, Strings: 8, Instructions: 892COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8B803A5E3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B803A5FB
ERR_new.LIBCRYPTO-3 ref: 00007FF8B803A790
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B803A7A8
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FF8B803A896
EVP_CIPHER_get_flags.LIBCRYPTO-3 ref: 00007FF8B803A89E
ERR_new.LIBCRYPTO-3 ref: 00007FF8B803A8CF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B803A8E7
ERR_new.LIBCRYPTO-3 ref: 00007FF8B803AA56
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B803AA6E
ERR_new.LIBCRYPTO-3 ref: 00007FF8B803B399
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B803B3B1
ERR_new.LIBCRYPTO-3 ref: 00007FF8B803B3C3
ERR_new.LIBCRYPTO-3 ref: 00007FF8B803B3CF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B803B3E7

Strings

CONNE, xrefs: 00007FF8B803B2DD
ssl3_get_record, xrefs: 00007FF8B803A5ED, 00007FF8B803A79A, 00007FF8B803A8D9, 00007FF8B803A929, 00007FF8B803A959, 00007FF8B803A981, 00007FF8B803A9AE, 00007FF8B803AA5B, 00007FF8B803AAA4, 00007FF8B803ABF9, 00007FF8B803AC21, 00007FF8B803AC8D, 00007FF8B803AD17, 00007FF8B803AE27, 00007FF8B803AFF5, 00007FF8B803B0CB, 00007FF8B803B100, 00007FF8B803B135, 00007FF8B803B16C, 00007FF8B803B1A3, 00007FF8B803B1DA, 00007FF8B803B20F, 00007FF8B803B2F6, 00007FF8B803B330, 00007FF8B803B3A3, 00007FF8B803B3D4
POST , xrefs: 00007FF8B803B290
PUT , xrefs: 00007FF8B803B2C9
GET , xrefs: 00007FF8B803B26D
, xrefs: 00007FF8B803AA4C
..\s\ssl\record\ssl3_record.c, xrefs: 00007FF8B803A5F4, 00007FF8B803A7A1, 00007FF8B803A8E0, 00007FF8B803A930, 00007FF8B803A960, 00007FF8B803A98D, 00007FF8B803A9BA, 00007FF8B803AA67, 00007FF8B803AAB0, 00007FF8B803AC05, 00007FF8B803AC2D, 00007FF8B803AC64, 00007FF8B803AC99, 00007FF8B803AD23, 00007FF8B803AE33, 00007FF8B803B001, 00007FF8B803B090, 00007FF8B803B0B2, 00007FF8B803B0D7, 00007FF8B803B10C, 00007FF8B803B141, 00007FF8B803B178, 00007FF8B803B1AF, 00007FF8B803B1E6, 00007FF8B803B21B, 00007FF8B803B302, 00007FF8B803B33C, 00007FF8B803B3AA, 00007FF8B803B3E0
HEAD , xrefs: 00007FF8B803B2AE

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: R_new$R_set_debug$R_get_flagsX_get0_cipher
String ID: $..\s\ssl\record\ssl3_record.c$CONNE$GET $HEAD $POST $PUT $ssl3_get_record
API String ID: 1830453883-2781224710
Opcode ID: 5844f7621a1cbe1188d8689772c9c6c5490e683883325f7f9fc13d7db788595b
Instruction ID: 32dc7df625113b803f1f4441bf89a53f520472002cbc852a8fafe6b0840088d8
Opcode Fuzzy Hash: 5844f7621a1cbe1188d8689772c9c6c5490e683883325f7f9fc13d7db788595b
Instruction Fuzzy Hash: 2C929C32A4EA4285FF20DB2AD8547B922A0EB497C8F544136DB4D4B6D6CF3CE583D319

Function 00007FF8B7FF1618 Relevance: 65.1, APIs: 23, Strings: 14, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF8B8008A68
ERR_set_mark.LIBCRYPTO-3 ref: 00007FF8B8008A92
EVP_SIGNATURE_fetch.LIBCRYPTO-3 ref: 00007FF8B8008AA8
EVP_KEYEXCH_fetch.LIBCRYPTO-3 ref: 00007FF8B8008AD4
EVP_KEYEXCH_fetch.LIBCRYPTO-3 ref: 00007FF8B8008B03
EVP_KEYEXCH_free.LIBCRYPTO-3 ref: 00007FF8B8008B1C
EVP_SIGNATURE_fetch.LIBCRYPTO-3 ref: 00007FF8B8008B32
EVP_SIGNATURE_free.LIBCRYPTO-3 ref: 00007FF8B8008B48
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FF8B8008B4D
EVP_PKEY_asn1_find_str.LIBCRYPTO-3 ref: 00007FF8B8008BA5
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3 ref: 00007FF8B8008BC5
EVP_PKEY_asn1_find_str.LIBCRYPTO-3 ref: 00007FF8B8008C15
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3 ref: 00007FF8B8008C35
EVP_PKEY_asn1_find_str.LIBCRYPTO-3 ref: 00007FF8B8008C88
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3 ref: 00007FF8B8008CA8
EVP_PKEY_asn1_find_str.LIBCRYPTO-3 ref: 00007FF8B8008CFB
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3 ref: 00007FF8B8008D1B
EVP_PKEY_asn1_find_str.LIBCRYPTO-3 ref: 00007FF8B8008D6E
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3 ref: 00007FF8B8008D8E
EVP_PKEY_asn1_find_str.LIBCRYPTO-3 ref: 00007FF8B8008DCD
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3 ref: 00007FF8B8008DED
EVP_PKEY_asn1_find_str.LIBCRYPTO-3 ref: 00007FF8B8008E2C
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3 ref: 00007FF8B8008E4C

Strings

, xrefs: 00007FF8B8008BE8
gost2001, xrefs: 00007FF8B8008D5F
ECDH, xrefs: 00007FF8B8008AF9
gost-mac, xrefs: 00007FF8B8008B63
, xrefs: 00007FF8B8008C58
gost2012_256, xrefs: 00007FF8B8008DBE
magma-mac, xrefs: 00007FF8B8008C79
, xrefs: 00007FF8B8008D3E
, xrefs: 00007FF8B8008CCB
ECDSA, xrefs: 00007FF8B8008B28
gost2012_512, xrefs: 00007FF8B8008E1D
DSA, xrefs: 00007FF8B8008A9E
kuznyechik-mac, xrefs: 00007FF8B8008CEC
gost-mac-12, xrefs: 00007FF8B8008C06

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: Y_asn1_find_strY_asn1_get0_info$E_fetchH_fetch$D_get_sizeE_freeH_freeR_pop_to_markR_set_mark
String ID: $ $ $ $DSA$ECDH$ECDSA$gost-mac$gost-mac-12$gost2001$gost2012_256$gost2012_512$kuznyechik-mac$magma-mac
API String ID: 4252356852-365409564
Opcode ID: 7caece2b3d371fe002a5019b5f5ffa2af5cf230c7cefdfd470046396768acd30
Instruction ID: a5b1358fdeb0b5ba687e3fa28352c306e09e566855861b92e60f890d3bc8860c
Opcode Fuzzy Hash: 7caece2b3d371fe002a5019b5f5ffa2af5cf230c7cefdfd470046396768acd30
Instruction Fuzzy Hash: B2E1A172A09B9285EB50DF28D8816A937A0FB547D8F041135FF4E466E9DF38E193C708

Function 00007FF8B800CB40 Relevance: 61.4, APIs: 34, Strings: 1, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8B800CBA4
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8B800CBC6
CRYPTO_free_ex_data.LIBCRYPTO-3 ref: 00007FF8B800CBF8
OPENSSL_LH_free.LIBCRYPTO-3 ref: 00007FF8B800CC01
X509_STORE_free.LIBCRYPTO-3 ref: 00007FF8B800CC0A
CTLOG_STORE_free.LIBCRYPTO-3 ref: 00007FF8B800CC16
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FF8B800CC1F
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FF8B800CC28
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FF8B800CC31
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FF8B800CC50
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FF8B800CC63
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FF8B800CC76
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FF8B800CC89
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8B800CCB6
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8B800CCCF
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8B800CCE8
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8B800CD01
CRYPTO_secure_free.LIBCRYPTO-3 ref: 00007FF8B800CD1A
EVP_MD_get0_provider.LIBCRYPTO-3 ref: 00007FF8B800CD2E
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B800CD3B
EVP_MD_get0_provider.LIBCRYPTO-3 ref: 00007FF8B800CD4F
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B800CD5C
EVP_CIPHER_get0_provider.LIBCRYPTO-3 ref: 00007FF8B800CD7B
EVP_CIPHER_free.LIBCRYPTO-3 ref: 00007FF8B800CD88
EVP_MD_get0_provider.LIBCRYPTO-3 ref: 00007FF8B800CDAF
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B800CDBC
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8B800CDF9
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8B800CE17
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8B800CE35
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8B800CE5E
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8B800CE77
CRYPTO_THREAD_lock_free.LIBCRYPTO-3 ref: 00007FF8B800CE83
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8B800CE9C
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8B800CEB1

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B800CB97, 00007FF8B800CBB0, 00007FF8B800CCA9, 00007FF8B800CCC2, 00007FF8B800CCDB, 00007FF8B800CCF4, 00007FF8B800CD0D, 00007FF8B800CDE8, 00007FF8B800CE05, 00007FF8B800CE23, 00007FF8B800CE51, 00007FF8B800CE6A, 00007FF8B800CE8F, 00007FF8B800CEA7

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: O_free$L_sk_free$D_freeD_get0_providerL_sk_pop_free$E_free$D_lock_freeH_freeO_free_ex_dataO_secure_freeR_freeR_get0_providerX509_
String ID: ..\s\ssl\ssl_lib.c
API String ID: 234229340-1080266419
Opcode ID: a85317bcf1e3dd943ddaaa58e8500dd1fdc06cb60adce51610fef9f1495ee99f
Instruction ID: 216ae52978b1b1523ce8c24d06772ea04232b5caa289c6188e9e17d91470d2cd
Opcode Fuzzy Hash: a85317bcf1e3dd943ddaaa58e8500dd1fdc06cb60adce51610fef9f1495ee99f
Instruction Fuzzy Hash: A6910421B08A4784EE50EF2AD5912B92361EF85FC4F485032EF1D4B6EADF79E5438358

Function 00007FF8B7FF1992 Relevance: 58.0, APIs: 31, Strings: 2, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8B800D32F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B800D347
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8B800D357
ERR_new.LIBCRYPTO-3 ref: 00007FF8B800D381
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B800D399
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8B800D3AA
ERR_new.LIBCRYPTO-3 ref: 00007FF8B800D3AF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B800D3C7
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8B800D3D8
CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FF8B800D411
CRYPTO_THREAD_lock_new.LIBCRYPTO-3 ref: 00007FF8B800D428
ERR_new.LIBCRYPTO-3 ref: 00007FF8B800D439
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B800D451
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8B800D462
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8B800D477
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FF8B800D499
OPENSSL_LH_new.LIBCRYPTO-3 ref: 00007FF8B800D510
X509_STORE_new.LIBCRYPTO-3 ref: 00007FF8B800D522
CTLOG_STORE_new_ex.LIBCRYPTO-3 ref: 00007FF8B800D53A
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FF8B800D5CE
X509_VERIFY_PARAM_new.LIBCRYPTO-3 ref: 00007FF8B800D5DB
OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FF8B800D61E
OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FF8B800D633
CRYPTO_new_ex_data.LIBCRYPTO-3 ref: 00007FF8B800D657
CRYPTO_secure_zalloc.LIBCRYPTO-3 ref: 00007FF8B800D676
RAND_bytes_ex.LIBCRYPTO-3 ref: 00007FF8B800D6CB
RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FF8B800D6E5
RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FF8B800D703
RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FF8B800D728
ERR_new.LIBCRYPTO-3 ref: 00007FF8B800D786
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B800D79E

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B800D340, 00007FF8B800D392, 00007FF8B800D3C0, 00007FF8B800D405, 00007FF8B800D44A, 00007FF8B800D46D, 00007FF8B800D48F, 00007FF8B800D66A, 00007FF8B800D797
SSL_CTX_new_ex, xrefs: 00007FF8B800D334, 00007FF8B800D386, 00007FF8B800D3B4, 00007FF8B800D43E, 00007FF8B800D78B

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: R_newR_set_debug$R_set_error$D_priv_bytes_ex$L_sk_new_nullX509_$D_bytes_exD_lock_newE_newE_new_exH_newL_sk_numM_newO_freeO_new_ex_dataO_secure_zallocO_strdupO_zalloc
String ID: ..\s\ssl\ssl_lib.c$SSL_CTX_new_ex
API String ID: 864562269-27091654
Opcode ID: 0ef21fb0b24aa75d52d15136eef25518695f37dfed3ffb2822b27bc7d2223680
Instruction ID: 7f4bbadfda95476c6653084d35f36a73e9992674a5c864a429f7afef1cd76232
Opcode Fuzzy Hash: 0ef21fb0b24aa75d52d15136eef25518695f37dfed3ffb2822b27bc7d2223680
Instruction Fuzzy Hash: 38C16962A19B4785FF50EB29A4517AD2291AF44BC4F480135EF4D4A7E6EF3CE503C329

Function 00007FF8B8F78E7C Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 171
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyWeakref_GetObject.PYTHON312 ref: 00007FF8B8F78EA8
SSL_get_rbio.LIBSSL-3 ref: 00007FF8B8F78F07
BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8B8F78F1C
SSL_get_wbio.LIBSSL-3 ref: 00007FF8B8F78F26
BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8B8F78F37
_PyDeadline_Init.PYTHON312 ref: 00007FF8B8F78F52

Part of subcall function 00007FF8B8F766B0: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FF8B8F766C8
Part of subcall function 00007FF8B8F766B0: ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8B8F766F1

PyEval_SaveThread.PYTHON312 ref: 00007FF8B8F78F6B
SSL_do_handshake.LIBSSL-3 ref: 00007FF8B8F78F78
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B8F78FB7
PyErr_CheckSignals.PYTHON312 ref: 00007FF8B8F78FCE
_PyDeadline_Get.PYTHON312 ref: 00007FF8B8F78FE6
_Py_Dealloc.PYTHON312 ref: 00007FF8B8F7904A
PyErr_SetString.PYTHON312 ref: 00007FF8B8F79088
_Py_Dealloc.PYTHON312 ref: 00007FF8B8F790A0

Strings

Underlying socket connection gone, xrefs: 00007FF8B8F78ED2
_ssl.c:983: The handshake operation timed out, xrefs: 00007FF8B8F790CF
_ssl.c:987: Underlying socket has been closed., xrefs: 00007FF8B8F79075
_ssl.c:991: Underlying socket too large for select()., xrefs: 00007FF8B8F7906C

Memory Dump Source

Source File: 00000003.00000002.2173879135.00007FF8B8F71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000003.00000002.2173859317.00007FF8B8F70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173899433.00007FF8B8F7D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173922137.00007FF8B8F90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173941068.00007FF8B8F91000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173959324.00007FF8B8F97000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173978125.00007FF8B8F99000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8f70000_LKEAHetlG6.jbxd

Similarity

API ID: Deadline_DeallocErr_Eval_O_ctrlThread$CheckInitL_do_handshakeL_get_rbioL_get_wbioObjectR_clear_errorR_peek_last_errorRestoreSaveSignalsStringWeakref_
String ID: Underlying socket connection gone$_ssl.c:983: The handshake operation timed out$_ssl.c:987: Underlying socket has been closed.$_ssl.c:991: Underlying socket too large for select().
API String ID: 3614085790-1145532335
Opcode ID: 8a5c9fe5bcf377cdba9e53c39a3d49a307c0a6e1fd9fad0d33650c7998d7eefc
Instruction ID: ef3a27ad73842ccc4a0c897f4679647792acad1a7cf4cada61f4747e9401b18a
Opcode Fuzzy Hash: 8a5c9fe5bcf377cdba9e53c39a3d49a307c0a6e1fd9fad0d33650c7998d7eefc
Instruction Fuzzy Hash: EB61493AB19E4286FB61AB2A98505792BA1FF89BC6F540131DF0E47759DF3DE4438308

Function 00007FF7E5D85F90 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7E5D85FD5

Part of subcall function 00007FF7E5D85928: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D8593C

Part of subcall function 00007FF7E5D7A574: HeapFree.KERNEL32(?,?,?,00007FF7E5D830B2,?,?,?,00007FF7E5D830EF,?,?,00000000,00007FF7E5D835B5,?,?,?,00007FF7E5D834E7), ref: 00007FF7E5D7A58A
Part of subcall function 00007FF7E5D7A574: GetLastError.KERNEL32(?,?,?,00007FF7E5D830B2,?,?,?,00007FF7E5D830EF,?,?,00000000,00007FF7E5D835B5,?,?,?,00007FF7E5D834E7), ref: 00007FF7E5D7A594

Part of subcall function 00007FF7E5D7A954: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7E5D7A933,?,?,?,?,?,00007FF7E5D7A81E), ref: 00007FF7E5D7A95D
Part of subcall function 00007FF7E5D7A954: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7E5D7A933,?,?,?,?,?,00007FF7E5D7A81E), ref: 00007FF7E5D7A982

_get_daylight.LIBCMT ref: 00007FF7E5D85FC4

Part of subcall function 00007FF7E5D85988: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D8599C

_get_daylight.LIBCMT ref: 00007FF7E5D8623A
_get_daylight.LIBCMT ref: 00007FF7E5D8624B
_get_daylight.LIBCMT ref: 00007FF7E5D8625C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E5D8649C), ref: 00007FF7E5D86283

Strings

Eastern Standard Time, xrefs: 00007FF7E5D86329
Eastern Summer Time, xrefs: 00007FF7E5D86341

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 9283cef0635022cc07389bf1168982caad64e3fafe3433b06e29da1bda549ea4
Instruction ID: 1d8aa4930c3a64a11fdde48458f28e214c433d3ba20f0995045280f60047b630
Opcode Fuzzy Hash: 9283cef0635022cc07389bf1168982caad64e3fafe3433b06e29da1bda549ea4
Instruction Fuzzy Hash: 37D1A326E0821A85EB10FF25D4E03B9A661EB54FA4FC44137EA4DCB686DE3CE441C762

Function 00007FF8B8038810 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FF8B80388B1
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8B803895A
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FF8B8038975
ERR_new.LIBCRYPTO-3 ref: 00007FF8B80389E4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B80389F1

Strings

ssl3_setup_read_buffer, xrefs: 00007FF8B80388C0
ssl3_setup_write_buffer, xrefs: 00007FF8B80389CE
..\s\ssl\record\ssl3_buffer.c, xrefs: 00007FF8B803883B

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: O_malloc$O_freeR_newR_set_debug
String ID: ..\s\ssl\record\ssl3_buffer.c$ssl3_setup_read_buffer$ssl3_setup_write_buffer
API String ID: 2137838121-2302522825
Opcode ID: ee7e063a5a246d61d598412ba2803017176e8ff550e4fa26b15343c4d60ff2d8
Instruction ID: 0e5ad055cc6aeebdca03ff226f9a908783cfea5f2622fa4f3428d62a91a1f5c7
Opcode Fuzzy Hash: ee7e063a5a246d61d598412ba2803017176e8ff550e4fa26b15343c4d60ff2d8
Instruction Fuzzy Hash: 6D519A72A09B4186EB10DB1AE8447A963E8EB88BC8F590536DF4C477D5DF38D443C308

Function 00007FF7E5D86CF4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5D86A28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D86A69
Part of subcall function 00007FF7E5D86A28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D86AE7
Part of subcall function 00007FF7E5D86A28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D86B38

CreateFileW.KERNEL32 ref: 00007FF7E5D86DFA
CreateFileW.KERNEL32 ref: 00007FF7E5D86E4A
GetLastError.KERNEL32 ref: 00007FF7E5D86E7A
GetFileType.KERNEL32 ref: 00007FF7E5D86E8F
GetLastError.KERNEL32 ref: 00007FF7E5D86E99
CloseHandle.KERNEL32 ref: 00007FF7E5D86ECC
CloseHandle.KERNEL32 ref: 00007FF7E5D8702F
CreateFileW.KERNEL32 ref: 00007FF7E5D87064
GetLastError.KERNEL32 ref: 00007FF7E5D87073

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 7e03ef3d0a20c94a2012376284489c35dd0980ac60203fd93d959aa726f203d8
Instruction ID: 84bb2e2ef4f60f4c9833d1c1e054364cd258cc40cbf93a89c79e1bf8e0c05d80
Opcode Fuzzy Hash: 7e03ef3d0a20c94a2012376284489c35dd0980ac60203fd93d959aa726f203d8
Instruction Fuzzy Hash: E4C1C132B28A4985EB10EF64D4E16AC7771E749FA8B814236DB1EDB794DF38E051C311

Function 00007FF7E5D8620C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7E5D8623A

Part of subcall function 00007FF7E5D85988: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D8599C

_get_daylight.LIBCMT ref: 00007FF7E5D8624B

Part of subcall function 00007FF7E5D85928: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D8593C

_get_daylight.LIBCMT ref: 00007FF7E5D8625C

Part of subcall function 00007FF7E5D85958: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D8596C

Part of subcall function 00007FF7E5D7A574: HeapFree.KERNEL32(?,?,?,00007FF7E5D830B2,?,?,?,00007FF7E5D830EF,?,?,00000000,00007FF7E5D835B5,?,?,?,00007FF7E5D834E7), ref: 00007FF7E5D7A58A
Part of subcall function 00007FF7E5D7A574: GetLastError.KERNEL32(?,?,?,00007FF7E5D830B2,?,?,?,00007FF7E5D830EF,?,?,00000000,00007FF7E5D835B5,?,?,?,00007FF7E5D834E7), ref: 00007FF7E5D7A594

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E5D8649C), ref: 00007FF7E5D86283

Strings

Eastern Standard Time, xrefs: 00007FF7E5D86329
Eastern Summer Time, xrefs: 00007FF7E5D86341

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: c4d5097cd75f94c8fd8ae5c0a6db21b68cc710d0165bcf2bafe064b9ca7a5653
Instruction ID: 8ee27bd43ee17b89b6dceec69bd9670fda615cb6b330dfc06c800c7eeef1add9
Opcode Fuzzy Hash: c4d5097cd75f94c8fd8ae5c0a6db21b68cc710d0165bcf2bafe064b9ca7a5653
Instruction Fuzzy Hash: CF516F22E1864A86E710FF25E4E02A9A760FB58B94FC44137EA5DCB796DF3CE401C761

Function 00007FF7E5D67990 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF7E5D679C3
FindClose.KERNEL32 ref: 00007FF7E5D679D2

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 0d24089257937bf4d8f75b282e589f98d2e605d2659b39465ed8206b1681d219
Instruction ID: bd70c973abb893a7a30716a83dd9b85d020a6e973b80047431b01720e5325092
Opcode Fuzzy Hash: 0d24089257937bf4d8f75b282e589f98d2e605d2659b39465ed8206b1681d219
Instruction Fuzzy Hash: 08F0C872A1C64AC6F760DB64B4E8366B390BB44B74F800337EAAE466D4DF7CD0498B01

Function 00007FF8B8F77AE4 Relevance: 79.0, APIs: 34, Strings: 11, Instructions: 218
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyType_GetModuleByDef.PYTHON312(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77B0D
PyErr_SetString.PYTHON312(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77B2C
TLS_server_method.LIBSSL-3(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77B85
TLS_client_method.LIBSSL-3(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77B90
PyErr_WarnEx.PYTHON312(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77BAF
TLSv1_2_method.LIBSSL-3(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77BBE
PyErr_WarnEx.PYTHON312(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77BDA
TLSv1_1_method.LIBSSL-3(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77BE9
PyErr_WarnEx.PYTHON312(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77C05
TLSv1_method.LIBSSL-3(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77C14
PyErr_WarnEx.PYTHON312(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77C30
TLS_method.LIBSSL-3(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77C3F
PyErr_Format.PYTHON312(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77C61
PyEval_SaveThread.PYTHON312(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77C6C
SSL_CTX_new.LIBSSL-3(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77C78
PyEval_RestoreThread.PYTHON312(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77C84
PyModule_GetState.PYTHON312(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77C92
SSL_CTX_free.LIBSSL-3(?,?,?,?,?,00007FF8B8F770AF), ref: 00007FF8B8F77CC9
PyModule_GetState.PYTHON312 ref: 00007FF8B8F77CFE
_Py_Dealloc.PYTHON312 ref: 00007FF8B8F77D3A
SSL_CTX_set_options.LIBSSL-3 ref: 00007FF8B8F77D61
SSL_CTX_set_cipher_list.LIBSSL-3 ref: 00007FF8B8F77D7C
ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8B8F77D86
PyErr_SetString.PYTHON312 ref: 00007FF8B8F77D9B
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FF8B8F77DC4
PyErr_Format.PYTHON312 ref: 00007FF8B8F77DE2
_Py_Dealloc.PYTHON312 ref: 00007FF8B8F77DF6
ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8B8F77DFC
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FF8B8F77E16
SSL_CTX_set_session_id_context.LIBSSL-3 ref: 00007FF8B8F77E2D
SSL_CTX_get0_param.LIBSSL-3 ref: 00007FF8B8F77E37
X509_VERIFY_PARAM_set_flags.LIBCRYPTO-3 ref: 00007FF8B8F77E48
X509_VERIFY_PARAM_set_hostflags.LIBCRYPTO-3 ref: 00007FF8B8F77E54
SSL_CTX_set_post_handshake_auth.LIBSSL-3 ref: 00007FF8B8F77E64

Strings

Cannot find internal module state, xrefs: 00007FF8B8F77B22
No cipher can be selected., xrefs: 00007FF8B8F77D90
Python, xrefs: 00007FF8B8F77E20
ssl.PROTOCOL_TLSv1_2 is deprecated, xrefs: 00007FF8B8F77BA2
HIGH:!aNULL:!eNULL, xrefs: 00007FF8B8F77D75
@SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM, xrefs: 00007FF8B8F77D67
ssl.PROTOCOL_TLS is deprecated, xrefs: 00007FF8B8F77C23
Failed to set minimum protocol 0x%x, xrefs: 00007FF8B8F77DD5
ssl.PROTOCOL_TLSv1_1 is deprecated, xrefs: 00007FF8B8F77BCD
ssl.PROTOCOL_TLSv1 is deprecated, xrefs: 00007FF8B8F77BF8
invalid or unsupported protocol version %i, xrefs: 00007FF8B8F77C54

Memory Dump Source

Source File: 00000003.00000002.2173879135.00007FF8B8F71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000003.00000002.2173859317.00007FF8B8F70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173899433.00007FF8B8F7D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173922137.00007FF8B8F90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173941068.00007FF8B8F91000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173959324.00007FF8B8F97000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173978125.00007FF8B8F99000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8f70000_LKEAHetlG6.jbxd

Similarity

API ID: Err_$Warn$DeallocEval_FormatModule_R_clear_errorStateStringThreadX509_X_ctrl$M_set_flagsM_set_hostflagsModuleRestoreS_client_methodS_methodS_server_methodSaveSv1_1_methodSv1_2_methodSv1_methodType_X_freeX_get0_paramX_newX_set_cipher_listX_set_optionsX_set_post_handshake_authX_set_session_id_context
String ID: @SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM$Cannot find internal module state$Failed to set minimum protocol 0x%x$HIGH:!aNULL:!eNULL$No cipher can be selected.$Python$invalid or unsupported protocol version %i$ssl.PROTOCOL_TLS is deprecated$ssl.PROTOCOL_TLSv1 is deprecated$ssl.PROTOCOL_TLSv1_1 is deprecated$ssl.PROTOCOL_TLSv1_2 is deprecated
API String ID: 4028604904-3748777976
Opcode ID: f0debb439b25d11fb0f191f54120526bd12ae595d34760f05303b375fde36367
Instruction ID: deee25ad269e88b692364c8544d836d230933bbc0cecebb3435232d158ebc568
Opcode Fuzzy Hash: f0debb439b25d11fb0f191f54120526bd12ae595d34760f05303b375fde36367
Instruction Fuzzy Hash: 6BA13D39A19E02C2FB54AB2DE9542782BA1FF84BD6F504135CB0E47768DF7CE45A8308

Function 00007FF8B7FF1C1C Relevance: 70.6, APIs: 37, Strings: 3, Instructions: 617COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8B8036A29
ERR_new.LIBCRYPTO-3 ref: 00007FF8B8036C60
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B8036C78
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B80373E3

Strings

SSL alert number %d, xrefs: 00007FF8B80371C8
ssl3_read_bytes, xrefs: 00007FF8B8036C65, 00007FF8B8036DE3, 00007FF8B8036FCA, 00007FF8B8037106, 00007FF8B8037133, 00007FF8B803716B, 00007FF8B80371A5, 00007FF8B8037206, 00007FF8B8037233, 00007FF8B803729C, 00007FF8B80372CE, 00007FF8B8037311, 00007FF8B803733D, 00007FF8B80373D5
..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FF8B8036C71, 00007FF8B8036DEF, 00007FF8B8036FD6, 00007FF8B8037112, 00007FF8B803713F, 00007FF8B8037177, 00007FF8B80371B1, 00007FF8B8037212, 00007FF8B803723F, 00007FF8B80372A8, 00007FF8B80372D5, 00007FF8B803731D, 00007FF8B8037344, 00007FF8B80373DC

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\record\rec_layer_s3.c$SSL alert number %d$ssl3_read_bytes
API String ID: 193678381-3615793073
Opcode ID: 381c6c421e8021476aeda6a916ac96ac20e7bda4ea2bb99a447231b109823cd9
Instruction ID: 598c2d289f7f7bf48ea83d93e934b0c102821da4a5f6484edcac3179caa01eaf
Opcode Fuzzy Hash: 381c6c421e8021476aeda6a916ac96ac20e7bda4ea2bb99a447231b109823cd9
Instruction Fuzzy Hash: E4528C22A49682C5FF608B2AD4503BE36A1EF49BC4F548135CB5E0AAD5CF3DE487D709

Function 00007FF8B8F7849C Relevance: 47.4, APIs: 22, Strings: 5, Instructions: 195
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F784D5
PyErr_SetString.PYTHON312 ref: 00007FF8B8F7851F
PyUnicode_FSConverter.PYTHON312 ref: 00007FF8B8F78531
PyErr_ExceptionMatches.PYTHON312 ref: 00007FF8B8F78545
PyUnicode_FSConverter.PYTHON312 ref: 00007FF8B8F78568
PyErr_ExceptionMatches.PYTHON312 ref: 00007FF8B8F7857C
PyUnicode_AsASCIIString.PYTHON312 ref: 00007FF8B8F785AB
PyErr_ExceptionMatches.PYTHON312 ref: 00007FF8B8F785C3
_Py_Dealloc.PYTHON312 ref: 00007FF8B8F78600
PyObject_CheckBuffer.PYTHON312 ref: 00007FF8B8F7862A
PyObject_GetBuffer.PYTHON312 ref: 00007FF8B8F7863E
PyBuffer_IsContiguous.PYTHON312 ref: 00007FF8B8F78652
PyBuffer_Release.PYTHON312 ref: 00007FF8B8F7867D
PyBuffer_Release.PYTHON312 ref: 00007FF8B8F78692
PyEval_SaveThread.PYTHON312 ref: 00007FF8B8F786B9
SSL_CTX_load_verify_locations.LIBSSL-3 ref: 00007FF8B8F786CC
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B8F786D7
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F786E1
PyErr_SetFromErrno.PYTHON312 ref: 00007FF8B8F786F6
ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8B8F786FC
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,00007FF8A8DEE1D0,?,?,00007FF8A8DEE1D0,?,00007FF8A8DEE1D0,00007FF8B8F7847C), ref: 00007FF8B8F78730
_Py_Dealloc.PYTHON312 ref: 00007FF8B8F7874A

Strings

cadata should be a contiguous buffer with a single dimension, xrefs: 00007FF8B8F78698
cafile, capath and cadata cannot be all omitted, xrefs: 00007FF8B8F7850E
cafile should be a valid filesystem path, xrefs: 00007FF8B8F78553
cadata should be an ASCII string or a bytes-like object, xrefs: 00007FF8B8F785D1
capath should be a valid filesystem path, xrefs: 00007FF8B8F7858A

Memory Dump Source

Source File: 00000003.00000002.2173879135.00007FF8B8F71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000003.00000002.2173859317.00007FF8B8F70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173899433.00007FF8B8F7D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173922137.00007FF8B8F90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173941068.00007FF8B8F91000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173959324.00007FF8B8F97000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173978125.00007FF8B8F99000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8f70000_LKEAHetlG6.jbxd

Similarity

API ID: Err_$Buffer_DeallocExceptionMatchesUnicode_$BufferConverterEval_Object_ReleaseStringThread_errno$CheckContiguousErrnoFromR_clear_errorRestoreSaveX_load_verify_locations
String ID: cadata should be a contiguous buffer with a single dimension$cadata should be an ASCII string or a bytes-like object$cafile should be a valid filesystem path$cafile, capath and cadata cannot be all omitted$capath should be a valid filesystem path
API String ID: 3554890122-3904065072
Opcode ID: 8830a4b544babb5a797f98cea38c61aa699872aff37fab41e20dddb9efd041ca
Instruction ID: aeeebede38384dfcf7d30dae378d824ff289f467d91ddd5b2c8b1b05f99ebdbd
Opcode Fuzzy Hash: 8830a4b544babb5a797f98cea38c61aa699872aff37fab41e20dddb9efd041ca
Instruction Fuzzy Hash: 33813D39A19E4285FB56AF6DE9442782BA1BF44BD6F544031CF0E47B98EF6CE446830C

Function 00007FF7E5D61000 Relevance: 40.6, APIs: 1, Strings: 22, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MEI, xrefs: 00007FF7E5D6284E
Failed to start splash screen!, xrefs: 00007FF7E5D62BA2
pyi-hide-console, xrefs: 00007FF7E5D627FA
WARNING: failed to remove temporary directory: %s, xrefs: 00007FF7E5D62C8E
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7E5D62B89
Failed to convert DLL search path!, xrefs: 00007FF7E5D62B12
minimize-late, xrefs: 00007FF7E5D6293F
pyi-runtime-tmpdir, xrefs: 00007FF7E5D627B0
pyi-contents-directory, xrefs: 00007FF7E5D627D5
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7E5D62B74
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7E5D6288C
hide-late, xrefs: 00007FF7E5D62922
minimize-early, xrefs: 00007FF7E5D62905
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7E5D629A4
hide-early, xrefs: 00007FF7E5D62812
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7E5D628EF
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7E5D62A95
pkg, xrefs: 00007FF7E5D628CF
ERROR: failed to remove temporary directory: %s, xrefs: 00007FF7E5D62C6F
_MEIPASS2, xrefs: 00007FF7E5D629F2, 00007FF7E5D629FE, 00007FF7E5D62C09
Could not create temporary directory!, xrefs: 00007FF7E5D62AAA
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7E5D62A40

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: FileModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$hide-early$hide-late$minimize-early$minimize-late$pkg$pyi-contents-directory$pyi-hide-console$pyi-runtime-tmpdir
API String ID: 514040917-560148345
Opcode ID: 0a79b262c17fbbee7d128d6a0344f61a83c214c43c683da879bc311074e37079
Instruction ID: 80bb78816ac5842a7accb053fd8f9cb1ccb3faa5b08846ffe1cbba63402f27d8
Opcode Fuzzy Hash: 0a79b262c17fbbee7d128d6a0344f61a83c214c43c683da879bc311074e37079
Instruction Fuzzy Hash: D5024321A08A8B90EB11FB2594B43B99351AF54F84FC44273DA4DC66D6EFBCE546C332

Function 00007FF8B7FF14BF Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 243
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8B804E73A
SetLastError.KERNEL32 ref: 00007FF8B804E741
ERR_new.LIBCRYPTO-3 ref: 00007FF8B804E820
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B804E838
ERR_new.LIBCRYPTO-3 ref: 00007FF8B804E861
ERR_new.LIBCRYPTO-3 ref: 00007FF8B804E885
ERR_new.LIBCRYPTO-3 ref: 00007FF8B804E8A7
ERR_new.LIBCRYPTO-3 ref: 00007FF8B804E8C8
ERR_new.LIBCRYPTO-3 ref: 00007FF8B804E8EA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B804E902
ERR_new.LIBCRYPTO-3 ref: 00007FF8B804E939
ERR_new.LIBCRYPTO-3 ref: 00007FF8B804EA00
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B804EA18
ERR_new.LIBCRYPTO-3 ref: 00007FF8B804EA32
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B804EA4A
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8B804EA5B
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FF8B804EA69

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FF8B804E831, 00007FF8B804E8FB, 00007FF8B804EA11, 00007FF8B804EA43
state_machine, xrefs: 00007FF8B804E82A, 00007FF8B804E8F4, 00007FF8B804EA05, 00007FF8B804EA37

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: R_new$R_set_debug$ErrorLastM_freeR_clear_errorR_set_error
String ID: ..\s\ssl\statem\statem.c$state_machine
API String ID: 1370845099-1722249466
Opcode ID: 6f8aa62c0a17cd257a7cac7c3db44b12b48ed95985bfa37342f9ed60703b21dc
Instruction ID: 7c0fb277915b4e46f5c0a76131d81196b4323fd74167cf1495eebb87043fdbfd
Opcode Fuzzy Hash: 6f8aa62c0a17cd257a7cac7c3db44b12b48ed95985bfa37342f9ed60703b21dc
Instruction Fuzzy Hash: F8A18E21A4924385FFA0AB2DC4503BC22A5EF61BE4F684435DB4D466D6CF7CEA838359

Function 00007FF8B8CD4640 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyImport_ImportModuleLevelObject.PYTHON312 ref: 00007FF8B8CD4671
PyObject_GetAttr.PYTHON312 ref: 00007FF8B8CD46BD
PyUnicode_FromFormat.PYTHON312 ref: 00007FF8B8CD46DD
PyObject_GetItem.PYTHON312 ref: 00007FF8B8CD46F5
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD470C
PyDict_SetItem.PYTHON312 ref: 00007FF8B8CD472D
PyObject_SetItem.PYTHON312 ref: 00007FF8B8CD4735
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD474B
PyErr_Clear.PYTHON312 ref: 00007FF8B8CD477B
PyModule_GetFilenameObject.PYTHON312 ref: 00007FF8B8CD4784
PyUnicode_FromFormat.PYTHON312 ref: 00007FF8B8CD47A2
PyErr_SetImportError.PYTHON312 ref: 00007FF8B8CD47B9
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD47CD
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD47E1
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD47F5

Strings

cannot import name %R from %R (%S), xrefs: 00007FF8B8CD4792
%U.%U, xrefs: 00007FF8B8CD46D3

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$ItemObject_$Err_FormatFromImportObjectUnicode_$AttrClearDict_ErrorFilenameImport_LevelModuleModule_
String ID: %U.%U$cannot import name %R from %R (%S)
API String ID: 3630264407-438398067
Opcode ID: fcd6dac6a765cb05053f4bfe7cd39cb166bae5586e68d4d28e2f2c7c25a5bf2f
Instruction ID: 1d8082480687598a72191fca391dce7b6446c2bdc20ebc733a61002dd5f487a5
Opcode Fuzzy Hash: fcd6dac6a765cb05053f4bfe7cd39cb166bae5586e68d4d28e2f2c7c25a5bf2f
Instruction Fuzzy Hash: D95132B5A08A4282EBB49F19A82C67963A1BB45FD5F454031CF5D4BB58DF3CE446C704

Function 00007FF8B7FF1C62 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8B80554E4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B80554FC
ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8B8055531
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FF8B8055546
X509_get0_pubkey.LIBCRYPTO-3 ref: 00007FF8B8055551
ERR_new.LIBCRYPTO-3 ref: 00007FF8B8055587
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B805559F
ERR_new.LIBCRYPTO-3 ref: 00007FF8B80555E4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B80555FC

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8B80554F5, 00007FF8B8055598, 00007FF8B80555F5, 00007FF8B80556C7
tls_post_process_server_certificate, xrefs: 00007FF8B80554E9, 00007FF8B805558C, 00007FF8B80555E9, 00007FF8B80556BB

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: R_newR_set_debug$L_sk_valueR_clear_errorX509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c$tls_post_process_server_certificate
API String ID: 2779586248-3767186838
Opcode ID: db8201a799e0baeb7e7da45e6d94f051912b60767bec020adcc90b3d0adbc0ec
Instruction ID: 0cccc697a41561ae2a3e891ffb806156b2d7e7827d165d0c08a1602888e13d7e
Opcode Fuzzy Hash: db8201a799e0baeb7e7da45e6d94f051912b60767bec020adcc90b3d0adbc0ec
Instruction Fuzzy Hash: 08516B62B1968282EB50DB29D4953BD23A1EF85BC4F544031DB4D4B7E6DF3CE9838718

Function 00007FF8B7FF14F1 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF8B803779F
ERR_new.LIBCRYPTO-3 ref: 00007FF8B803783B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B8037853
SetLastError.KERNEL32 ref: 00007FF8B80378A2
BIO_read.LIBCRYPTO-3 ref: 00007FF8B80378C9
BIO_test_flags.LIBCRYPTO-3 ref: 00007FF8B80378EA
BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8B8037900
ERR_new.LIBCRYPTO-3 ref: 00007FF8B8037958
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B8037970
ERR_new.LIBCRYPTO-3 ref: 00007FF8B80379C0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B80379D8

Strings

ssl3_read_n, xrefs: 00007FF8B8037840, 00007FF8B803795D, 00007FF8B80379C5
..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FF8B803784C, 00007FF8B8037969, 00007FF8B80379D1

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: R_newR_set_debug$ErrorLastO_ctrlO_readO_test_flagsmemmove
String ID: ..\s\ssl\record\rec_layer_s3.c$ssl3_read_n
API String ID: 3874383451-4226281315
Opcode ID: b49a1a3092a1666878fcf2a6f1a6b22ad798a3b357faedcaa6a675de5e77afac
Instruction ID: 8838d111f878e4dec1504a933193c05ae8ac080c3fbff60d59e1b422b0e16bb2
Opcode Fuzzy Hash: b49a1a3092a1666878fcf2a6f1a6b22ad798a3b357faedcaa6a675de5e77afac
Instruction Fuzzy Hash: 67914A22B49686C6FF519B2AD8447B922A0EF48BD8F544236DF4C0BAD5DF38E447C308

Function 00007FF7E5D618D0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E5D66920: _fread_nolock.LIBCMT ref: 00007FF7E5D669CA

_fread_nolock.LIBCMT ref: 00007FF7E5D61994

Strings

MEI, xrefs: 00007FF7E5D61911
fread, xrefs: 00007FF7E5D619A6, 00007FF7E5D61ABB
Could not allocate buffer for TOC!, xrefs: 00007FF7E5D61A81
calloc, xrefs: 00007FF7E5D619D5
fseek, xrefs: 00007FF7E5D61970
Could not allocate memory for archive structure!, xrefs: 00007FF7E5D619CE
Failed to read cookie!, xrefs: 00007FF7E5D6199F
Could not read full TOC!, xrefs: 00007FF7E5D61AB4
Failed to seek to cookie position!, xrefs: 00007FF7E5D61969
malloc, xrefs: 00007FF7E5D61A88
Error on file., xrefs: 00007FF7E5D61AEA

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _fread_nolock
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 840049012-3497178890
Opcode ID: 5bbcd2a5d69c673e1a924a8e579b82d780a6b9d926f88ab32955420af60ae12e
Instruction ID: 07fa5c2ae3ade51ee55d144f5f55c2b0031b820dca9ee26c0f16a8f322b93139
Opcode Fuzzy Hash: 5bbcd2a5d69c673e1a924a8e579b82d780a6b9d926f88ab32955420af60ae12e
Instruction Fuzzy Hash: 7371D931A08A4AC9EB50FB54D4B03B9A360EB45F80F804233D54DCB755DEBCE1468762

Function 00007FF8B804E240 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

read_state_machine, xrefs: 00007FF8B804E4CD, 00007FF8B804E50A, 00007FF8B804E532, 00007FF8B804E5A5
..\s\ssl\statem\statem.c, xrefs: 00007FF8B804E4D4, 00007FF8B804E511, 00007FF8B804E53E, 00007FF8B804E5B1

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem.c$read_state_machine
API String ID: 0-3323778802
Opcode ID: 14377edc59a60446f09f780bfe0d0aa6ceb5de1d18d0f26ea132c90706a724b0
Instruction ID: 6ed8f202ea00dc5867742fdc1b10249feaf07d92eedce7854d2ecb4de7d15f54
Opcode Fuzzy Hash: 14377edc59a60446f09f780bfe0d0aa6ceb5de1d18d0f26ea132c90706a724b0
Instruction Fuzzy Hash: 1D918A62A0964786EF109F28D8543B927A1EB91BD8F584136DB0D4B7E6DF3CE647C308

Function 00007FF8B8CD8EC3 Relevance: 19.6, APIs: 13, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B8CD41E0: PyUnicode_FromStringAndSize.PYTHON312 ref: 00007FF8B8CD42E9
Part of subcall function 00007FF8B8CD41E0: PyUnicode_InternInPlace.PYTHON312 ref: 00007FF8B8CD4302

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD8F2B
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD8F63
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD8F7B
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD8F9E
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD8FC1
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD8FE4
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD9007
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD902A
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD904D
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD9070
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD9093
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD90B6
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD90D9

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Unicode_$FromInternPlaceSizeString
String ID:
API String ID: 2745024575-0
Opcode ID: 091893d1f0e79c71c802a693a5176002506af28f025ec817263c4d69333cf0a2
Instruction ID: 39b9f7ef707d9d8fe1f2cd20b99b6a38ff188595484f707bfb8e96597de9f092
Opcode Fuzzy Hash: 091893d1f0e79c71c802a693a5176002506af28f025ec817263c4d69333cf0a2
Instruction Fuzzy Hash: 5271D8B9D0AA0286FBE5AF2CB96C13433E4AF48BD6F144834C76D41A54DF2DB5478B18

Function 00007FF8B804EC70 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3(?,?,?,-00000031,00007FF8B804E9C6), ref: 00007FF8B804ED22
ERR_set_debug.LIBCRYPTO-3(?,?,?,-00000031,00007FF8B804E9C6), ref: 00007FF8B804ED3A

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FF8B804ED33, 00007FF8B804F022
write_state_machine, xrefs: 00007FF8B804ED2C, 00007FF8B804F01B

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem.c$write_state_machine
API String ID: 193678381-552286378
Opcode ID: 1edee16b17f7b7a209ddbeed6cd636bdd8764bdbe6572802cc707b3b873bb90e
Instruction ID: 35ee0b964a3621a9d1483c2addbc38d8a070f6818a6c0f51d81fe02014fa5256
Opcode Fuzzy Hash: 1edee16b17f7b7a209ddbeed6cd636bdd8764bdbe6572802cc707b3b873bb90e
Instruction Fuzzy Hash: A3A16922A4868386EB609F29D4543BD23A0EB91BD8F480136DB4D476E5DF3DEA47C708

Function 00007FF8B8F71C90 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B8F71CF2
PyUnicode_AsUTF8AndSize.PYTHON312 ref: 00007FF8B8F71D2E
PyObject_IsTrue.PYTHON312 ref: 00007FF8B8F71D63

Strings

txt2obj, xrefs: 00007FF8B8F7381D
argument 'txt', xrefs: 00007FF8B8F7380F
str, xrefs: 00007FF8B8F73816
embedded null character, xrefs: 00007FF8B8F73837

Memory Dump Source

Source File: 00000003.00000002.2173879135.00007FF8B8F71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000003.00000002.2173859317.00007FF8B8F70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173899433.00007FF8B8F7D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173922137.00007FF8B8F90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173941068.00007FF8B8F91000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173959324.00007FF8B8F97000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173978125.00007FF8B8F99000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8f70000_LKEAHetlG6.jbxd

Similarity

API ID: Arg_KeywordsObject_SizeTrueUnicode_Unpack
String ID: argument 'txt'$embedded null character$str$txt2obj
API String ID: 3371007025-2001486153
Opcode ID: e8ce7c660efa3040c30a1db54354426bbf27a23a7f35393858fb19190b2c85a0
Instruction ID: 4167bca9f190cadbb407840fe03fba445a99e32f2111733292b8bfb6a5904e83
Opcode Fuzzy Hash: e8ce7c660efa3040c30a1db54354426bbf27a23a7f35393858fb19190b2c85a0
Instruction Fuzzy Hash: EC31AB3AA08E4295FA609F19E8502B96B60FB84BD2F844131CB5E47799DF3CD48BC708

Function 00007FF7E5D61420 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7E5D6157A
fread, xrefs: 00007FF7E5D61581
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7E5D6144F
fseek, xrefs: 00007FF7E5D61490
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7E5D61489
malloc, xrefs: 00007FF7E5D614C0
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7E5D614B9

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 077e8b14b07a7cc32ad649ba2a3e64b58fc62f6872d1ece476a4769d3685b742
Instruction ID: 7f618cc36fcf15e4feaecf71b6cbd78a1b9a007a339bda92ffc41a6e37164398
Opcode Fuzzy Hash: 077e8b14b07a7cc32ad649ba2a3e64b58fc62f6872d1ece476a4769d3685b742
Instruction Fuzzy Hash: F041A621B0895A81EE20FB55A8A07B6E360EF04FD0FC44133DE4D8BB55EEBCE4468712

Function 00007FF7E5D611D0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154COMMON

Download Yara Rule

Strings

1.3.1, xrefs: 00007FF7E5D61209
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7E5D612A3
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7E5D61236
malloc, xrefs: 00007FF7E5D6127C, 00007FF7E5D612AA
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7E5D613CE
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7E5D61275

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: af13fbfa16edd7bb79b6fa6e8f7306b15fd9428bf7baef927f2c1b3844413e04
Instruction ID: 51a695f167d61901357dd67956f5360947df1af5b271fba7dcd51a59c37b4751
Opcode Fuzzy Hash: af13fbfa16edd7bb79b6fa6e8f7306b15fd9428bf7baef927f2c1b3844413e04
Instruction Fuzzy Hash: 8551F722A08A4A81E660FB51A4E03BAA291BB44F94FC44337DD4EC7BD5EF7CD406C711

Function 00007FF8B8F77000 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

PyType_GetModuleByDef.PYTHON312 ref: 00007FF8B8F77026
PyModule_GetState.PYTHON312 ref: 00007FF8B8F7702F
_PyArg_NoKeywords.PYTHON312 ref: 00007FF8B8F7705C
_PyArg_CheckPositional.PYTHON312 ref: 00007FF8B8F7707F
_PyLong_AsInt.PYTHON312 ref: 00007FF8B8F7708D
PyErr_Occurred.PYTHON312 ref: 00007FF8B8F7709A

Strings

_SSLContext, xrefs: 00007FF8B8F77055, 00007FF8B8F77078

Memory Dump Source

Source File: 00000003.00000002.2173879135.00007FF8B8F71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000003.00000002.2173859317.00007FF8B8F70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173899433.00007FF8B8F7D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173922137.00007FF8B8F90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173941068.00007FF8B8F91000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173959324.00007FF8B8F97000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173978125.00007FF8B8F99000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8f70000_LKEAHetlG6.jbxd

Similarity

API ID: Arg_$CheckErr_KeywordsLong_ModuleModule_OccurredPositionalStateType_
String ID: _SSLContext
API String ID: 3264916389-1468230856
Opcode ID: ec8d2544eb27ef1cf7f8a4d42c015db2229ec9701b346d633fb2f81f14b7e4b2
Instruction ID: 1d82e20b070b7b2436db6842572d0dbe165ab74a4d3efe27bbb56b6bb5df9c50
Opcode Fuzzy Hash: ec8d2544eb27ef1cf7f8a4d42c015db2229ec9701b346d633fb2f81f14b7e4b2
Instruction Fuzzy Hash: 97218139B19E42C1FE50AB2AE8401756BA1BF48FD2F484430DB5D83768DF6CE5928304

Function 00007FF7E5D7BB60 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D7BF8D

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f4d4eaa9f9719d9b01c1f0ada3a05cdcadf9cc5c0cd80aa5858acc27961052ac
Instruction ID: 01258c459f189981fe8f91295d2fcfa7a7af43e00fbb02bff0f1fd171c994737
Opcode Fuzzy Hash: f4d4eaa9f9719d9b01c1f0ada3a05cdcadf9cc5c0cd80aa5858acc27961052ac
Instruction Fuzzy Hash: 2DC1D722A0C68A81F760EB15D4E43BDF760EB81F80FD54132DA4E87791EE7DE8458722

Function 00007FF8B8060710 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8B8060836
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B806084E
ERR_new.LIBCRYPTO-3 ref: 00007FF8B80608CE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B80608E6

Strings

tls_get_message_header, xrefs: 00007FF8B806083B, 00007FF8B80608D3
..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8B8060847, 00007FF8B80608DF

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$tls_get_message_header
API String ID: 193678381-2714770296
Opcode ID: 0a675c68133e8178ac648a78a03b7d1437f40432096ecb796daf1537fba5ad51
Instruction ID: 7da88e8e81171886b81b6f9244005a5063ec454212a4c91d0c78fee2a633490f
Opcode Fuzzy Hash: 0a675c68133e8178ac648a78a03b7d1437f40432096ecb796daf1537fba5ad51
Instruction Fuzzy Hash: E6614E32A0978285EBA0CF29E4503AD37A1FB45BC8F088036DB8D57795DF38D556C728

Function 00007FF8B800FAE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8B800FB00
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8B800FB18
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8B800FB28
ASYNC_get_current_job.LIBCRYPTO-3 ref: 00007FF8B800FB75

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B800FB11
SSL_do_handshake, xrefs: 00007FF8B800FB05

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: C_get_current_jobR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_do_handshake
API String ID: 2134390360-2964568172
Opcode ID: c91630741219631a69d9c5f3432363629406958cc77146902cc34db31b5e4eda
Instruction ID: 12d3c43615b9880d7aaec8495e2687332751f9e59e8713655050a9f9ab54e127
Opcode Fuzzy Hash: c91630741219631a69d9c5f3432363629406958cc77146902cc34db31b5e4eda
Instruction Fuzzy Hash: 4D217423F0874682EA50EB39E4516AE6351EF897D4F580131EB4D467D6DF3CE5938A04

Function 00007FF7E5D625A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7E5D626F4), ref: 00007FF7E5D625D1

Part of subcall function 00007FF7E5D61ED0: GetLastError.KERNEL32 ref: 00007FF7E5D61EEC
Part of subcall function 00007FF7E5D61ED0: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E5D625EE,?,00007FF7E5D626F4), ref: 00007FF7E5D61F56

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF7E5D62621
Failed to obtain executable path., xrefs: 00007FF7E5D625DB
\\?\, xrefs: 00007FF7E5D62642
GetModuleFileNameW, xrefs: 00007FF7E5D625E2
Failed to convert executable path to UTF-8., xrefs: 00007FF7E5D62678

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ErrorFileFormatLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 1234058594-2863816727
Opcode ID: 65b9fcef5ef1d5fe4a0761813f3a61d529644fdc59a7ebe131a5006a953f7c10
Instruction ID: 8ad491b3e1a303de3165155a8f6276a08e7878babfc67b5bc1ffdb7b3ceb333a
Opcode Fuzzy Hash: 65b9fcef5ef1d5fe4a0761813f3a61d529644fdc59a7ebe131a5006a953f7c10
Instruction Fuzzy Hash: E1219761B1894B81FA20F724E8F43B99251AF58B94FC00337E65DC65E6EEBCD5068722

Function 00007FF8B8F71DA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

OBJ_txt2obj.LIBCRYPTO-3 ref: 00007FF8B8F71DC0
PyModule_GetState.PYTHON312 ref: 00007FF8B8F71DD5

Part of subcall function 00007FF8B8F71E08: OBJ_obj2nid.LIBCRYPTO-3(?,?,?,?,?,00007FF8B8F71DE6), ref: 00007FF8B8F71E2A
Part of subcall function 00007FF8B8F71E08: OBJ_nid2sn.LIBCRYPTO-3(?,?,?,?,?,00007FF8B8F71DE6), ref: 00007FF8B8F71E3C
Part of subcall function 00007FF8B8F71E08: OBJ_nid2ln.LIBCRYPTO-3(?,?,?,?,?,00007FF8B8F71DE6), ref: 00007FF8B8F71E47
Part of subcall function 00007FF8B8F71E08: _Py_BuildValue_SizeT.PYTHON312(?,?,?,?,?,00007FF8B8F71DE6), ref: 00007FF8B8F71E75

ASN1_OBJECT_free.LIBCRYPTO-3 ref: 00007FF8B8F71DEC
PyErr_Format.PYTHON312 ref: 00007FF8B8F73862

Strings

unknown object '%.100s', xrefs: 00007FF8B8F73855

Memory Dump Source

Source File: 00000003.00000002.2173879135.00007FF8B8F71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000003.00000002.2173859317.00007FF8B8F70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173899433.00007FF8B8F7D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173922137.00007FF8B8F90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173941068.00007FF8B8F91000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173959324.00007FF8B8F97000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173978125.00007FF8B8F99000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8f70000_LKEAHetlG6.jbxd

Similarity

API ID: BuildErr_FormatJ_nid2lnJ_nid2snJ_obj2nidJ_txt2objModule_SizeStateT_freeValue_
String ID: unknown object '%.100s'
API String ID: 2376969911-3113687063
Opcode ID: d9b4d4975734ea15646eee8fb9c3d0b379545d0c4b71bf7e6638dc8ceb9f44e1
Instruction ID: 527cd4755d853ed6f5c0d9860e9842e97c712a78b91cb30581faae5bb3a7756d
Opcode Fuzzy Hash: d9b4d4975734ea15646eee8fb9c3d0b379545d0c4b71bf7e6638dc8ceb9f44e1
Instruction Fuzzy Hash: 17F03679B19F4281FA04DB2BA9540395A51AF8CFD1F884031DF0E47B19DF2CE5868704

Function 00007FF8B9061000 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

PyImport_ImportModule.PYTHON312 ref: 00007FF8B906100B
_Py_Dealloc.PYTHON312 ref: 00007FF8B9061024
PyCapsule_Import.PYTHON312 ref: 00007FF8B9061033

Strings

charset_normalizer.md__mypyc.init_charset_normalizer___md, xrefs: 00007FF8B906102C
charset_normalizer.md__mypyc, xrefs: 00007FF8B9061004

Memory Dump Source

Source File: 00000003.00000002.2174014272.00007FF8B9061000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9060000, based on PE: true

Associated: 00000003.00000002.2173996919.00007FF8B9060000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000003.00000002.2174033510.00007FF8B9062000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000003.00000002.2174052648.00007FF8B9064000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b9060000_LKEAHetlG6.jbxd

Similarity

API ID: Import$Capsule_DeallocImport_Module
String ID: charset_normalizer.md__mypyc$charset_normalizer.md__mypyc.init_charset_normalizer___md
API String ID: 1394619730-824592145
Opcode ID: 5974c19f225ccfaa67e8cfdf14026b0452581abd6b019d6115b8283005d03241
Instruction ID: a4fba066cdd3ca95fecde39f0de6aff2f4316b0e295aef20fdc41ac0ea6e2fb5
Opcode Fuzzy Hash: 5974c19f225ccfaa67e8cfdf14026b0452581abd6b019d6115b8283005d03241
Instruction Fuzzy Hash: 8DE0C925E0D582C1FE99DF1D9C4427422E5AF64B80F858435C70D862A0EF7CE5878710

Function 00007FF8B7E08980 Relevance: 7.6, APIs: 5, Instructions: 134COMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF8B7E089E0
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF8B7E08A80

Memory Dump Source

Source File: 00000003.00000002.2169343526.00007FF8B7E01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF8B7E00000, based on PE: true

Associated: 00000003.00000002.2169321575.00007FF8B7E00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2169448185.00007FF8B7EB1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2169483594.00007FF8B7EE9000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2169506454.00007FF8B7EEC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7e00000_LKEAHetlG6.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 44d2f96c8e0af26a82585af827d67bc849b133391cf72f933bd2390903c4a44b
Instruction ID: 87a878a27a00377fb83c39c38b70e1740affae2391459eda43e3a251c1049063
Opcode Fuzzy Hash: 44d2f96c8e0af26a82585af827d67bc849b133391cf72f933bd2390903c4a44b
Instruction Fuzzy Hash: BD518520E0CB0381FA95A76CA55217D22A5AF44FE0F184639E72E67BF6DE2CF815C711

Function 00007FF7E5D7FD1C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7E5D7FE0C
_get_daylight.LIBCMT ref: 00007FF7E5D7FE1D
_get_daylight.LIBCMT ref: 00007FF7E5D7FE2E
_isindst.LIBCMT ref: 00007FF7E5D7FEF9

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4858f8cd19caa2a963f97c62f7cf419c6ccc0f2ddde666d924458c87d99ac7a2
Instruction ID: 52e4d0fc4e3a1b484f7fb02ef641a2cab7aacc78db1fe57eb946b48cf26e75d3
Opcode Fuzzy Hash: 4858f8cd19caa2a963f97c62f7cf419c6ccc0f2ddde666d924458c87d99ac7a2
Instruction Fuzzy Hash: 01510572F0415A8AEB24EB2498E17BCE7A1AB01B58FD00137DD2ED2AD5DF38A406C711

Function 00007FF7E5D75848 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7E5D7587B
GetFileInformationByHandle.KERNEL32 ref: 00007FF7E5D758DD
GetLastError.KERNEL32 ref: 00007FF7E5D7596E
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E5D75780), ref: 00007FF7E5D759BA

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: c8443f222f7955abaccbd633dd6c0c22e009ea4c1ae81d7bc85d106a4d3da070
Instruction ID: a59e641068627cf8044d5e84e4d0572f518067f47636c008b4aca1b618e6afa4
Opcode Fuzzy Hash: c8443f222f7955abaccbd633dd6c0c22e009ea4c1ae81d7bc85d106a4d3da070
Instruction Fuzzy Hash: AE518022E08645CAF710EF70D4A03BDA3A1EB48F58F948536DE4D9B689DF38D4818762

Function 00007FF7E5D756F4 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D75721
CreateFileW.KERNEL32 ref: 00007FF7E5D75760
CloseHandle.KERNEL32 ref: 00007FF7E5D75795

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: dd7eac1057e584b1087a132c8893c35ef1df72ce863294a3bcebda750911c608
Instruction ID: b41b8078646817d050b7b0494476512e79bded1f2fdf5a9101a16107430dbffa
Opcode Fuzzy Hash: dd7eac1057e584b1087a132c8893c35ef1df72ce863294a3bcebda750911c608
Instruction Fuzzy Hash: 4541C932D1874683F750EB20D5A0379A360FB95B94F509336E65C47AD5EF7CA4E08712

Function 00007FF8B7E084B0 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF8B7E084D7
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF8B7E08576

Memory Dump Source

Source File: 00000003.00000002.2169343526.00007FF8B7E01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF8B7E00000, based on PE: true

Associated: 00000003.00000002.2169321575.00007FF8B7E00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2169448185.00007FF8B7EB1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2169483594.00007FF8B7EE9000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2169506454.00007FF8B7EEC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7e00000_LKEAHetlG6.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 500a536d6c844823ace2e23cf9f0573e36f43f6c55640cbb5d5c94bcb2d445f8
Instruction ID: ca6e49e9ad944b609336e54f58948d80584389c7a751abcd2324dbccaefcacab
Opcode Fuzzy Hash: 500a536d6c844823ace2e23cf9f0573e36f43f6c55640cbb5d5c94bcb2d445f8
Instruction Fuzzy Hash: E0216D20A0DB0346FA98AB6CA9A617D62955F44FE4F140A38D73E577F6EE2CB805C710

Function 00007FF8B80174A0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

ERR_set_mark.LIBCRYPTO-3 ref: 00007FF8B80174CC
OBJ_nid2sn.LIBCRYPTO-3 ref: 00007FF8B80174D3
EVP_CIPHER_fetch.LIBCRYPTO-3 ref: 00007FF8B80174E1
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FF8B80174E9

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: J_nid2snR_fetchR_pop_to_markR_set_mark
String ID:
API String ID: 2772354928-0
Opcode ID: 9d6a64450acf58a63a50e4c19100a97fdf4d2fc7c8484d09c1bb12015f6b24b3
Instruction ID: d0b3f9443f89d85bb56d78be15410f8b976c691669c7cee24decdac4f417a3a9
Opcode Fuzzy Hash: 9d6a64450acf58a63a50e4c19100a97fdf4d2fc7c8484d09c1bb12015f6b24b3
Instruction Fuzzy Hash: FFF03011B0978141EE44B76A69811BD95519F99BC0F085438FF4D57BEBDF3CE5434608

Function 00007FF8B8F7B608 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON312 ref: 00007FF8B8F7B619

Part of subcall function 00007FF8B8F7B568: _Py_Dealloc.PYTHON312 ref: 00007FF8B8F7B58E
Part of subcall function 00007FF8B8F7B568: _Py_Dealloc.PYTHON312 ref: 00007FF8B8F7B5AD
Part of subcall function 00007FF8B8F7B568: _Py_Dealloc.PYTHON312 ref: 00007FF8B8F7B5CC
Part of subcall function 00007FF8B8F7B568: PyEval_SaveThread.PYTHON312 ref: 00007FF8B8F7B5D9
Part of subcall function 00007FF8B8F7B568: BIO_free_all.LIBCRYPTO-3 ref: 00007FF8B8F7B5E6
Part of subcall function 00007FF8B8F7B568: PyEval_RestoreThread.PYTHON312 ref: 00007FF8B8F7B5EF

SSL_CTX_free.LIBSSL-3 ref: 00007FF8B8F7B62B
PyMem_Free.PYTHON312 ref: 00007FF8B8F7B635
_Py_Dealloc.PYTHON312 ref: 00007FF8B8F7B656

Memory Dump Source

Source File: 00000003.00000002.2173879135.00007FF8B8F71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000003.00000002.2173859317.00007FF8B8F70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173899433.00007FF8B8F7D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173922137.00007FF8B8F90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173941068.00007FF8B8F91000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173959324.00007FF8B8F97000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173978125.00007FF8B8F99000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8f70000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Eval_Thread$FreeMem_O_free_allObject_RestoreSaveTrackX_free
String ID:
API String ID: 3459953665-0
Opcode ID: 18b80c608f07c00e641e9ef01e57d6251f686d03cb591226dae76ac8af8e4881
Instruction ID: 1710ef8f2f864aa890690832a55a6a1896a76468dbd704b2e8d11ace96e052dc
Opcode Fuzzy Hash: 18b80c608f07c00e641e9ef01e57d6251f686d03cb591226dae76ac8af8e4881
Instruction Fuzzy Hash: ECF0B73AA09E4281FB04AF2AE9441786760EB89FD6F485031DB1E06369DF38D4A6C304

Function 00007FF8B7E062A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF8B7E062FC
GetFileType.KERNEL32 ref: 00007FF8B7E06312

Strings

@, xrefs: 00007FF8B7E06362

Memory Dump Source

Source File: 00000003.00000002.2169343526.00007FF8B7E01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF8B7E00000, based on PE: true

Associated: 00000003.00000002.2169321575.00007FF8B7E00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2169448185.00007FF8B7EB1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2169483594.00007FF8B7EE9000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2169506454.00007FF8B7EEC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7e00000_LKEAHetlG6.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 10c4fa39cb729f91123b6bf367b60b64fb3467f7e4e6d2d3a76a5de364945ac9
Instruction ID: 9ec903ad32084451927f5fb50bb693f10858364012d7afe7f07e59bc183ae37b
Opcode Fuzzy Hash: 10c4fa39cb729f91123b6bf367b60b64fb3467f7e4e6d2d3a76a5de364945ac9
Instruction Fuzzy Hash: 56218222A08B4281EB608B2D949123D2A54EF99FB4F651335D7AF177F4CF3DD881D281

Function 00007FF8B804E5EC Relevance: 4.8, APIs: 3, Instructions: 344COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8B804E73A
SetLastError.KERNEL32 ref: 00007FF8B804E741
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FF8B804EA69

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: ce68793f5ed94765da0cf06069d6cda8a1f14ed55aa43607596081dc107df58f
Instruction ID: c47aedc5736e0bf378985a74f7070bca6da9a2811d0cbb6b964a4012c31c4bf8
Opcode Fuzzy Hash: ce68793f5ed94765da0cf06069d6cda8a1f14ed55aa43607596081dc107df58f
Instruction Fuzzy Hash: 7231AE72A486438AFB649E29948127D27B0FF60BE4F5C4435DF49426C6DF38EA83C748

Function 00007FF8B7FF1DF2 Relevance: 4.6, APIs: 3, Instructions: 87COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8B804E73A
SetLastError.KERNEL32 ref: 00007FF8B804E741
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FF8B804EA69

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: 30f5a756a2453722bd5fc7c60f00636787785f570310c9cdf96fb774af82a049
Instruction ID: 5a3629bcb56c17b2e61e5ca0a39fec328fe63faa42f9992ba9dd318b9604b7db
Opcode Fuzzy Hash: 30f5a756a2453722bd5fc7c60f00636787785f570310c9cdf96fb774af82a049
Instruction Fuzzy Hash: 4B318132B4924389FF64AE29944027D23A1FF60BE4F2C4431DF49466C5CF38EA838748

Function 00007FF7E5D79A80 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7E5D79A7C), ref: 00007FF7E5D79A91
TerminateProcess.KERNEL32(?,?,?,00007FF7E5D79A7C), ref: 00007FF7E5D79A9C
ExitProcess.KERNEL32 ref: 00007FF7E5D79AAB

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2c24119f787965044d627fb85e1f935b4d689670476c95a23688f33a408cf2b4
Instruction ID: 8738c7caec70a2ce43ecf0ac8f8c8e9f8d601cc13cc7dfb246650bfd4ff8fdb3
Opcode Fuzzy Hash: 2c24119f787965044d627fb85e1f935b4d689670476c95a23688f33a408cf2b4
Instruction Fuzzy Hash: 9DD06711B09A0A82EA54FB7158E527893519F48F41F90143AC90E9A7A3DD3DA44D4322

Function 00007FF8B8CE252E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE253D

Strings

<module>, xrefs: 00007FF8B8CE3822

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc
String ID: <module>
API String ID: 3617616757-217463007
Opcode ID: 3d0b5fe31bdceefd0d16471987016516823057e139ed2a49c540c935358a7bd8
Instruction ID: 3e8cafcb2950519cf78992ef36e6cbfa6f8a23f6a9acb4d4add8c0bcdf269608
Opcode Fuzzy Hash: 3d0b5fe31bdceefd0d16471987016516823057e139ed2a49c540c935358a7bd8
Instruction Fuzzy Hash: 64F030E6E0A61782FBA59F1DA83817423506F447D2F804035DF2E07660DF2CB5438708

Function 00007FF7E5D6E7E4 Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D6E828
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D6E91F

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6bf03d38dba950430044e224e6de6b096b3435415f1f736879eee21a3c0d5c6e
Instruction ID: 36e9fc17dbc5c8a8a14236c195034bd1519fd7f3e2a804523b7263f780c0c2d8
Opcode Fuzzy Hash: 6bf03d38dba950430044e224e6de6b096b3435415f1f736879eee21a3c0d5c6e
Instruction Fuzzy Hash: 4C511B61A09A4985FA64EA25D4A077BE395FF84FA4F844733DD6C873C5CE7CE4028623

Function 00007FF7E5D6B34C Relevance: 3.1, APIs: 2, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5D6B52C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7E5D6B540

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7E5D6B375
__scrt_release_startup_lock.LIBCMT ref: 00007FF7E5D6B3E3

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 1236291503-0
Opcode ID: 59deef07c40312847f55d6def9df2cc1f37e1ab7e24cf60098a74783f5463ac3
Instruction ID: bb06c77d0b068aae47c222dec58b1ee92c332d2b7d1ebfd99fb31e2d717bf95d
Opcode Fuzzy Hash: 59deef07c40312847f55d6def9df2cc1f37e1ab7e24cf60098a74783f5463ac3
Instruction Fuzzy Hash: 84310C21A0890A41FA10FB6594F13B99391AF45F84FC40237EA0DCB697DEBDE4068733

Function 00007FF7E5D7C51C Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7E5D7C595
GetFileType.KERNEL32 ref: 00007FF7E5D7C5AB

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 3071b830118634cb40028611ceeffb06fc3458eceab3432db34a7b9b2b67f05b
Instruction ID: 20d7e1fcdb42c568aebb9b76a4652e811f424277b428323c85735526b3a6bfc8
Opcode Fuzzy Hash: 3071b830118634cb40028611ceeffb06fc3458eceab3432db34a7b9b2b67f05b
Instruction Fuzzy Hash: B8318622A18B4A85DB64DB1495E4278A750FB45FB0BA4133ADB6F973F0CF39E461C312

Function 00007FF7E5D7AB70 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,?,?,00007FF7E5D7A9ED,?,?,00000000,00007FF7E5D7AAA2), ref: 00007FF7E5D7ABDE
GetLastError.KERNEL32(?,?,?,00007FF7E5D7A9ED,?,?,00000000,00007FF7E5D7AAA2), ref: 00007FF7E5D7ABE8

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 8421e8a4af99ada878c6549736f5471f2f7f62c165e76de116515189c6a53e17
Instruction ID: bb38d8d9627652b323903c953e6964eb6a845ee33388cb88f18b2e7f4fc491c5
Opcode Fuzzy Hash: 8421e8a4af99ada878c6549736f5471f2f7f62c165e76de116515189c6a53e17
Instruction Fuzzy Hash: 75218021B1864A41EE50F71595E03BD93829F44FA0F884277EA1FC63D6DE7CA4408322

Function 00007FF8B7E0E040 Relevance: 3.0, APIs: 2, Instructions: 50memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF8B7E4D82A,?,?,?,00007FF8B7E47AE1,?,?,?,?,00007FF8B7E05036,?,?,?), ref: 00007FF8B7E0E088

Memory Dump Source

Source File: 00000003.00000002.2169343526.00007FF8B7E01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF8B7E00000, based on PE: true

Associated: 00000003.00000002.2169321575.00007FF8B7E00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2169448185.00007FF8B7EB1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2169483594.00007FF8B7EE9000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2169506454.00007FF8B7EEC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7e00000_LKEAHetlG6.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1615ab53de4aabf0c0b3efcd15b96cedb5e4b59eb6f957d50f43ffb1f4246435
Instruction ID: 6f63c9517ea11e85149613c8c53a9a47e9eae4d23238ade17edca7798b247680
Opcode Fuzzy Hash: 1615ab53de4aabf0c0b3efcd15b96cedb5e4b59eb6f957d50f43ffb1f4246435
Instruction Fuzzy Hash: FD11A060B1D70399FAA59B2EE84167E2740AF85FE0F485A34CB1E477F1DE2CE4018310

Function 00007FF7E5D7C238 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF7E5D7C224,?,?,?,00000000,?,00007FF7E5D7C32D), ref: 00007FF7E5D7C284
GetLastError.KERNEL32(?,?,?,?,?,00007FF7E5D7C224,?,?,?,00000000,?,00007FF7E5D7C32D), ref: 00007FF7E5D7C28E

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7c3c9af7b0c3ba882c1d4f7bd1684166dd02ec46220af4d411bd6b8cca88beee
Instruction ID: ab790ea5212036ddf3ff685b11882b1f518d11cc284b7d035df233ff9b72e31b
Opcode Fuzzy Hash: 7c3c9af7b0c3ba882c1d4f7bd1684166dd02ec46220af4d411bd6b8cca88beee
Instruction Fuzzy Hash: 12110421708B4585DA10EB65A890269B361AB45FF0F944332EF7E8B7F9CE3CD0548301

Function 00007FF7E5D759F0 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E5D75905), ref: 00007FF7E5D75A23
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E5D75905), ref: 00007FF7E5D75A39

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 24756dbb2e9daa31db72e7dcf0b088d8d1bf88fd8db7438d69b0fd56222304ee
Instruction ID: 88a2b113beec132d9060e1ae12630e8ecbdceb0f929e1016bbaa4f34e4db20fb
Opcode Fuzzy Hash: 24756dbb2e9daa31db72e7dcf0b088d8d1bf88fd8db7438d69b0fd56222304ee
Instruction Fuzzy Hash: 0B11C43160CA47C2EA50EB50A4A123BF3A0FB80B64F900237E69DC59E4EF7CE014CB11

Function 00007FF8B7E074C0 Relevance: 2.5, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF8B7E074CD

Part of subcall function 00007FF8B7E061AC: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF8B7E06113), ref: 00007FF8B7E061D8
Part of subcall function 00007FF8B7E061AC: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF8B7E06113), ref: 00007FF8B7E0622D

LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF8B7E074F3

Part of subcall function 00007FF8B7E0624C: GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF8B7E0626C

Part of subcall function 00007FF8B7E062A0: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF8B7E062FC
Part of subcall function 00007FF8B7E062A0: GetFileType.KERNEL32 ref: 00007FF8B7E06312

Memory Dump Source

Source File: 00000003.00000002.2169343526.00007FF8B7E01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF8B7E00000, based on PE: true

Associated: 00000003.00000002.2169321575.00007FF8B7E00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2169448185.00007FF8B7EB1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2169483594.00007FF8B7EE9000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2169506454.00007FF8B7EEC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7e00000_LKEAHetlG6.jbxd

Similarity

API ID: CriticalSection$EnterLeave$FileHandleInfoStartupType
String ID:
API String ID: 2762830733-0
Opcode ID: c868589744674d6913eb51937418dee57fcc5d1debfb9aa775668d33186eab68
Instruction ID: 2c80d66dc9ca392ead2ca7b0d239aabcccae3b634acc54f6c9953c4f147da3b9
Opcode Fuzzy Hash: c868589744674d6913eb51937418dee57fcc5d1debfb9aa775668d33186eab68
Instruction Fuzzy Hash: D4E01260E1970396FA55ABB998931BD27249F65FD1F940430D72F812B2DF2DB4898331

Function 00007FF7E5D7BFB0 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D7BFD8

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 23e1e69210e6edff46c1a20a99ff15067d5ab76a9899098d0cc9a0d673f9d892
Instruction ID: e649007bf089f39f780ecdc6575de7680b3a64027ecc315f4919987ca4c2fc40
Opcode Fuzzy Hash: 23e1e69210e6edff46c1a20a99ff15067d5ab76a9899098d0cc9a0d673f9d892
Instruction Fuzzy Hash: 7F41A23290820947EA34EB19E5A0379F7A0EB55F84F900132E79EC7691DF7DE4428B62

Function 00007FF8B804E330 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

BUF_MEM_grow_clean.LIBCRYPTO-3(?,?,?,?,-00000031,?,00007FF8B804E9A4), ref: 00007FF8B804E3D7

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: M_grow_clean
String ID:
API String ID: 964628749-0
Opcode ID: ff409e93fcb0d36c1aaad829d7e6a47c84e60de949b34c47c74b208e88b9b461
Instruction ID: d8dbba95050a3801df7bde3629f100758063d75c6997144dfc9b205624ec6e59
Opcode Fuzzy Hash: ff409e93fcb0d36c1aaad829d7e6a47c84e60de949b34c47c74b208e88b9b461
Instruction Fuzzy Hash: 4C415862A4968786EF249F29D55437927A1EB90BE8F0C8235CB4D077D8DF38E9438708

Function 00007FF7E5D66920 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7E5D669CA

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 7216689617feb61d33e57569e3dc3bdfa95d4bc45a68d70d8a0bb8748856956d
Instruction ID: b44e74e4cdd5e6167fef009561d08621196f67ab34df33db47234438e10d1f6c
Opcode Fuzzy Hash: 7216689617feb61d33e57569e3dc3bdfa95d4bc45a68d70d8a0bb8748856956d
Instruction Fuzzy Hash: D321F515B08A9545FA10FB1264A03B6D655BF45FD4FCC5132DD0CCB786CEBCE002C211

Function 00007FF7E5D7BA40 Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D7BAC6

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf7c005c1e31e7ea229f5223e293a291a449fd9923c8bf07186dd3c48721cc09
Instruction ID: 060e359b53ea74a89029151b7caba7d62548b4faa1025cee738e813131d9a72e
Opcode Fuzzy Hash: cf7c005c1e31e7ea229f5223e293a291a449fd9923c8bf07186dd3c48721cc09
Instruction Fuzzy Hash: 4B314B31A18A1A85F651FB15C8E137DA7A0AB84F95FC10137E95D833D2EEBCE4418732

Function 00007FF8B8F783A8 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B8F7842D

Memory Dump Source

Source File: 00000003.00000002.2173879135.00007FF8B8F71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000003.00000002.2173859317.00007FF8B8F70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173899433.00007FF8B8F7D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173922137.00007FF8B8F90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173941068.00007FF8B8F91000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173959324.00007FF8B8F97000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2173978125.00007FF8B8F99000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8f70000_LKEAHetlG6.jbxd

Similarity

API ID: Arg_KeywordsUnpack
String ID:
API String ID: 1409375599-0
Opcode ID: 4f70251f1997f56840d150c754dbca9097f8bb8d4c3a8e005e7515773daa2ba7
Instruction ID: 800e273401185d1bedc27e49271d18608ca141d8e167aaed5270e283681d7f32
Opcode Fuzzy Hash: 4f70251f1997f56840d150c754dbca9097f8bb8d4c3a8e005e7515773daa2ba7
Instruction Fuzzy Hash: DB21BF7AB19F9285FA52CF4AA8009696BA4FB08BC6F850032DF4C17764DF7CE412C708

Function 00007FF8B7FF1F46 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8B8000598

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: f7c6bf918bb27fd1467e601db5dcc4726319ecb0557afeb55f8d086d6d4849ab
Instruction ID: 6d59bc65e5386a412a741db91220e4d59c0737f5e1f12823e1b6a83fbba24211
Opcode Fuzzy Hash: f7c6bf918bb27fd1467e601db5dcc4726319ecb0557afeb55f8d086d6d4849ab
Instruction Fuzzy Hash: 76316B32609B8586EB508F25E440BDE7760FB85BC8F484136EF8D4BB99CF78D5468B05

Function 00007FF7E5D799B1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7E5D799DF

Part of subcall function 00007FF7E5D79AD8: GetModuleHandleExW.KERNEL32 ref: 00007FF7E5D79AFD
Part of subcall function 00007FF7E5D79AD8: GetProcAddress.KERNEL32 ref: 00007FF7E5D79B13
Part of subcall function 00007FF7E5D79AD8: FreeLibrary.KERNEL32 ref: 00007FF7E5D79B3A

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 7cdee7fffdefcbc5027b0452851aa9c5becd2890f0ec4c7d98fb6386710e4df3
Instruction ID: 53dd3645560323c07f38c5bbd90eef94d996653e450535415b903c7754004667
Opcode Fuzzy Hash: 7cdee7fffdefcbc5027b0452851aa9c5becd2890f0ec4c7d98fb6386710e4df3
Instruction Fuzzy Hash: F521BC32E16A4A8AEB20EF64D0903FC33A0EB44B18F840636D71C86BC5DF38E544C761

Function 00007FF7E5D76064 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D75FC9

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0c710f33dd0e263908a6af9c5a326f17bec47833feda8bc3952fb7c3f2c9ef99
Instruction ID: acab20d629447e40b6fc36418a9e07e146ab3954db447a62e2800b8356d25f80
Opcode Fuzzy Hash: 0c710f33dd0e263908a6af9c5a326f17bec47833feda8bc3952fb7c3f2c9ef99
Instruction Fuzzy Hash: 26113B22A0864A82EA61FF51D4A037DE764AF85F84FD44436EB4CD7A96DF7CD4408723

Function 00007FF7E5D866E4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D86707

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 371a19b6cbb4e76029cb4c6dd0e3fb09161d29462ff652c7a237cc4efd58c973
Instruction ID: 5a16e5f50a988be2b83ceaa9f51f6c4cb6b1a99df5a56666b334ceedf7dc96f1
Opcode Fuzzy Hash: 371a19b6cbb4e76029cb4c6dd0e3fb09161d29462ff652c7a237cc4efd58c973
Instruction Fuzzy Hash: 99219532618A8586EB61EF28E490379B7A0EB94F64F944236E65DCB6D9DF3CD400CB11

Function 00007FF7E5D6EA64 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5D6EAB8

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 94cde1b0722b00ce3a89043d06a8f6ad091ac7731aa2d118b4c7a57a40d7012b
Instruction ID: c437a6fe87a684590ccf9062512332648797e325ce58314c12a44863ab715e2a
Opcode Fuzzy Hash: 94cde1b0722b00ce3a89043d06a8f6ad091ac7731aa2d118b4c7a57a40d7012b
Instruction Fuzzy Hash: 4001E525A08B4941E900EB52985026AE7A5FF85FE0F884332EE6C97BD6DE7CD0028712

Function 00007FF7E5D7D8D4 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF7E5D7D83D,?,?,?,00007FF7E5D7130F), ref: 00007FF7E5D7D912

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ed43cc8fef10e4de0f6b38702312381f943abf623902b3a88b5f27f9598a1dfd
Instruction ID: f33393a323d1d32bed2dea43ef79e6a35a63c48db595b0586744881d5e4690c1
Opcode Fuzzy Hash: ed43cc8fef10e4de0f6b38702312381f943abf623902b3a88b5f27f9598a1dfd
Instruction Fuzzy Hash: 7DF0D411A0D20E81FE54BBA158A137593845F48FA0FC84632DA2FCA2D2EF3CA4808232

Function 00007FF8B7FF1D43 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8B804EC36

Memory Dump Source

Source File: 00000003.00000002.2169553619.00007FF8B7FF1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B7FF0000, based on PE: true

Associated: 00000003.00000002.2169532124.00007FF8B7FF0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169553619.00007FF8B8072000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169625335.00007FF8B8074000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2169807307.00007FF8B809C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80A7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2170139722.00007FF8B80AF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7ff0000_LKEAHetlG6.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: bfe36b7522bdb383b583256963e0cb7d483da4068be122a2aa8aa4264da1dd87
Instruction ID: 492777270081b81db3f8a93cecb0bb9ca4318f4fea9ff0fe3d13e4bb873545dc
Opcode Fuzzy Hash: bfe36b7522bdb383b583256963e0cb7d483da4068be122a2aa8aa4264da1dd87
Instruction Fuzzy Hash: 47E048B2F4510246FB10576D9446B6812A0EF58794F581030DB0D8A7C3EBBDE9D38A08

Function 00007FF7E5D6B52C Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7E5D6B540

Part of subcall function 00007FF7E5D6BF68: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF7E5D6BF70
Part of subcall function 00007FF7E5D6BF68: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF7E5D6BF75

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 42f905f2e02464d1f18fe0bfc90ee21d32569e03344996040c3241f949aa798e
Instruction ID: 4a1ba82924cbf903f4ed39b5ecf66fb5eb69ddb59fdb2b815cc36457744e5213
Opcode Fuzzy Hash: 42f905f2e02464d1f18fe0bfc90ee21d32569e03344996040c3241f949aa798e
Instruction Fuzzy Hash: E8E07E70D09A4B85FE64B66115F23F982401F21B04EC412BBE84DC61A3ADAEA4471633

Function 00007FF7E5D67480 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5D67AA0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7E5D631F4,00000000,00007FF7E5D61905), ref: 00007FF7E5D67AD9

LoadLibraryW.KERNEL32(?,00007FF7E5D64E86,?,00007FF7E5D6224E), ref: 00007FF7E5D674A2

Memory Dump Source

Source File: 00000003.00000002.2166711767.00007FF7E5D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E5D60000, based on PE: true

Associated: 00000003.00000002.2166666805.00007FF7E5D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166739478.00007FF7E5D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5D9F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166764970.00007FF7E5DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2166803328.00007FF7E5DA7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7e5d60000_LKEAHetlG6.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 306e0b7f68d1bf48911d9a5e828091665b68987f1fa19b16ae1329a1af92c6f2
Instruction ID: 1834ce427fac4956876bb98a554dd42f443836eac8f2d7c081c0f00c3659d91a
Opcode Fuzzy Hash: 306e0b7f68d1bf48911d9a5e828091665b68987f1fa19b16ae1329a1af92c6f2
Instruction Fuzzy Hash: 2AD0C201F2464A41EA44F76BBA96639A2519FC9FD0FC8D036EE0E87B56DC3CC0810B00

Non-executed Functions

Function 00007FF8B93C18C0 Relevance: 86.1, APIs: 30, Strings: 19, Instructions: 334threadCOMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B93C198C
PyObject_GetBuffer.PYTHON312 ref: 00007FF8B93C19A8
PyBuffer_IsContiguous.PYTHON312 ref: 00007FF8B93C19BC
PyObject_GetBuffer.PYTHON312 ref: 00007FF8B93C19FA
PyBuffer_IsContiguous.PYTHON312 ref: 00007FF8B93C1A0F
PyLong_AsUnsignedLong.PYTHON312 ref: 00007FF8B93C1AE5
PyLong_AsUnsignedLong.PYTHON312 ref: 00007FF8B93C1B0D
PyLong_AsUnsignedLong.PYTHON312 ref: 00007FF8B93C1B21
EVP_PBE_scrypt.LIBCRYPTO-3 ref: 00007FF8B93C1B78
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FF8B93C1B8D
PyEval_SaveThread.PYTHON312 ref: 00007FF8B93C1B9B
EVP_PBE_scrypt.LIBCRYPTO-3 ref: 00007FF8B93C1BDD
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B93C1BE8
PyErr_SetString.PYTHON312 ref: 00007FF8B93C1C0C
PyBuffer_Release.PYTHON312 ref: 00007FF8B93C1C4D
PyBuffer_Release.PYTHON312 ref: 00007FF8B93C1C60
PyLong_AsLong.PYTHON312 ref: 00007FF8B93C1C89
PyErr_Occurred.PYTHON312 ref: 00007FF8B93C1C97
PyLong_AsLong.PYTHON312 ref: 00007FF8B93C1CDF
PyErr_Occurred.PYTHON312 ref: 00007FF8B93C1CF2
PyErr_Format.PYTHON312 ref: 00007FF8B93C1D38
_PyArg_BadArgument.PYTHON312 ref: 00007FF8B93C1D5B
_PyArg_BadArgument.PYTHON312 ref: 00007FF8B93C1D7E
_PyArg_BadArgument.PYTHON312 ref: 00007FF8B93C1DA1
PyErr_Occurred.PYTHON312 ref: 00007FF8B93C1DE1

Strings

contiguous buffer, xrefs: 00007FF8B93C4EF7, 00007FF8B93C4F1C
salt is too long., xrefs: 00007FF8B93C4F5F
argument 'salt', xrefs: 00007FF8B93C4F23
argument 'n', xrefs: 00007FF8B93C1D54
n is required and must be an unsigned int, xrefs: 00007FF8B93C1DD5
salt is required, xrefs: 00007FF8B93C1DB3
scrypt, xrefs: 00007FF8B93C1D4D, 00007FF8B93C1D70, 00007FF8B93C1D93, 00007FF8B93C4F05, 00007FF8B93C4F2A
@, xrefs: 00007FF8B93C1913
argument 'password', xrefs: 00007FF8B93C4EFE
dklen must be greater than 0 and smaller than %d, xrefs: 00007FF8B93C1D21
p is required and must be an unsigned int, xrefs: 00007FF8B93C1E19
r is required and must be an unsigned int, xrefs: 00007FF8B93C1DF7
n must be a power of 2., xrefs: 00007FF8B93C1C02
password is too long., xrefs: 00007FF8B93C4F4C
argument 'r', xrefs: 00007FF8B93C1D77
int, xrefs: 00007FF8B93C1D46, 00007FF8B93C1D69, 00007FF8B93C1D8C
maxmem must be positive and smaller than %d, xrefs: 00007FF8B93C1E25
argument 'p', xrefs: 00007FF8B93C1D9A
Invalid parameter combination for n, r, p, maxmem., xrefs: 00007FF8B93C1D0D

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_LongLong_$Arg_Buffer_$ArgumentOccurredUnsigned$BufferContiguousE_scryptEval_Object_ReleaseStringThread$Bytes_FormatFromKeywordsRestoreSaveSizeUnpack
String ID: @$Invalid parameter combination for n, r, p, maxmem.$argument 'n'$argument 'p'$argument 'password'$argument 'r'$argument 'salt'$contiguous buffer$dklen must be greater than 0 and smaller than %d$int$maxmem must be positive and smaller than %d$n is required and must be an unsigned int$n must be a power of 2.$p is required and must be an unsigned int$password is too long.$r is required and must be an unsigned int$salt is required$salt is too long.$scrypt
API String ID: 756542180-2474027488
Opcode ID: ce52e687de3379b197ac10c5f43fb21e19eb27817606f383836dadd5c04fb4b2
Instruction ID: 726d809799f8073302c341639b3808b240ec987455d28a32cf550085cb0fe31f
Opcode Fuzzy Hash: ce52e687de3379b197ac10c5f43fb21e19eb27817606f383836dadd5c04fb4b2
Instruction Fuzzy Hash: 1DF11925A08FC281EA548F69E8842BA63B0FF48BD5F54A135EF4E476A4DF3CE54D9340

Function 00007FF8B93C1580 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 220threadCOMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FF8B93C15E3
_Py_hashtable_get.PYTHON312 ref: 00007FF8B93C15F3
EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF8B93C161D
EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF8B93C1629
PyModule_GetState.PYTHON312 ref: 00007FF8B93C163A
_PyObject_New.PYTHON312 ref: 00007FF8B93C1643
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C1655
EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF8B93C1671
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B93C16B9
PyModule_GetState.PYTHON312 ref: 00007FF8B93C16CE
EVP_MD_fetch.LIBCRYPTO-3 ref: 00007FF8B93C1701
PyObject_CheckBuffer.PYTHON312 ref: 00007FF8B93C1733
PyObject_GetBuffer.PYTHON312 ref: 00007FF8B93C174C
PyBuffer_Release.PYTHON312 ref: 00007FF8B93C17A4
PyEval_SaveThread.PYTHON312 ref: 00007FF8B93C17AF
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B93C17D0
PyErr_SetString.PYTHON312 ref: 00007FF8B93C17E9
EVP_MD_fetch.LIBCRYPTO-3 ref: 00007FF8B93C1806
PyErr_SetString.PYTHON312 ref: 00007FF8B93C4E01
PyBuffer_Release.PYTHON312 ref: 00007FF8B93C4E0C
_Py_Dealloc.PYTHON312 ref: 00007FF8B93C4ECC

Strings

Buffer must be single dimension, xrefs: 00007FF8B93C4DF7
-fips, xrefs: 00007FF8B93C16F8, 00007FF8B93C4E65
Strings must be encoded before hashing, xrefs: 00007FF8B93C17D8
object supporting the buffer API required, xrefs: 00007FF8B93C4DE4
unsupported hash type %s, xrefs: 00007FF8B93C4E30

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Module_Object_State$BufferBuffer_D_fetchErr_Eval_ReleaseStringThread$CheckD_freeD_get_flagsD_up_refDeallocDigestInit_exPy_hashtable_getRestoreSaveX_new
String ID: -fips$Buffer must be single dimension$Strings must be encoded before hashing$object supporting the buffer API required$unsupported hash type %s
API String ID: 4208293270-2451375418
Opcode ID: 12aebaf60a2722ffa0df6d129a57d2c9aa7bff5e9fff1e8fcc399d5b5b6b9104
Instruction ID: cd71543e179eb97d07c9dd5490d1c51f9f9913eeba64f4232daeafe48de08a87
Opcode Fuzzy Hash: 12aebaf60a2722ffa0df6d129a57d2c9aa7bff5e9fff1e8fcc399d5b5b6b9104
Instruction Fuzzy Hash: 45914D62A09FC282EA649F69A54427B63B4BF5DBD5F14B131EF4E026A0DF2DE45C9300

Function 00007FF8B9061A00 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B9061A1C
memset.VCRUNTIME140 ref: 00007FF8B9061A40
RtlCaptureContext.KERNEL32 ref: 00007FF8B9061A49
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B9061A63
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B9061AA4
memset.VCRUNTIME140 ref: 00007FF8B9061AD7
IsDebuggerPresent.KERNEL32 ref: 00007FF8B9061AF8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B9061B19
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B9061B24

Memory Dump Source

Source File: 00000003.00000002.2174014272.00007FF8B9061000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9060000, based on PE: true

Associated: 00000003.00000002.2173996919.00007FF8B9060000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000003.00000002.2174033510.00007FF8B9062000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000003.00000002.2174052648.00007FF8B9064000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b9060000_LKEAHetlG6.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: d2fc5c816bc886ec48474e1f3de92b9dad2b167a0f664e979cdb826d70fdf180
Instruction ID: dd900f95fc774ebebf4ab518e844f4cdbf18ebf4992d46ee01f804e0eb0b9d18
Opcode Fuzzy Hash: d2fc5c816bc886ec48474e1f3de92b9dad2b167a0f664e979cdb826d70fdf180
Instruction Fuzzy Hash: 51312D72609AC18AEBA0DF68E8503ED7361FB84784F44443ADB4D87A95DF38D649C710

Function 00007FF8B8CE42E8 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B8CE4304
memset.VCRUNTIME140 ref: 00007FF8B8CE4328
RtlCaptureContext.KERNEL32 ref: 00007FF8B8CE4331
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B8CE434B
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B8CE438C
memset.VCRUNTIME140 ref: 00007FF8B8CE43BF
IsDebuggerPresent.KERNEL32 ref: 00007FF8B8CE43E0
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B8CE4401
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B8CE440C

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 163f402a1fb0e79306561b7d1351dc0227e06d1d27abfb67021ae25e867ac1b0
Instruction ID: a49004d9288681a0ce1ba8210e8815904c562c5f7e57e547ffe8c45bf8069947
Opcode Fuzzy Hash: 163f402a1fb0e79306561b7d1351dc0227e06d1d27abfb67021ae25e867ac1b0
Instruction Fuzzy Hash: 1D3162B2604B8186EBA08F64E8643ED3360FB44785F404439DB5E47B98DF3CE649C704

Function 00007FF8B8B33E60 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B8B33E7C
memset.VCRUNTIME140 ref: 00007FF8B8B33EA0
RtlCaptureContext.KERNEL32 ref: 00007FF8B8B33EA9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B8B33EC3
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B8B33F04
memset.VCRUNTIME140 ref: 00007FF8B8B33F37
IsDebuggerPresent.KERNEL32 ref: 00007FF8B8B33F58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B8B33F75
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B8B33F80

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 3d249a4d3ec741f06bccba3fca43a7136d5c4f0ed13e34deacf6695f45bbc58d
Instruction ID: 2c7ba7c56294cdb018d441c877ca0a347bb3e29d73db44db1a06c0ec7be3d814
Opcode Fuzzy Hash: 3d249a4d3ec741f06bccba3fca43a7136d5c4f0ed13e34deacf6695f45bbc58d
Instruction Fuzzy Hash: ED313E72649B818AEB609F74E8903EE7360FB88784F44403ADB4E47B98DF38D549C714

Function 00007FF8B93C4620 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B93C463C
memset.VCRUNTIME140 ref: 00007FF8B93C4660
RtlCaptureContext.KERNEL32 ref: 00007FF8B93C4669
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B93C4683
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B93C46C4
memset.VCRUNTIME140 ref: 00007FF8B93C46F7
IsDebuggerPresent.KERNEL32 ref: 00007FF8B93C4718
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B93C4735
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B93C4740

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: f6967d108f3b71c995da1153c54bfbbbd78574a52a3cc597769a049e7cdf8063
Instruction ID: 05d6b8569c67bba877fe1a4ef056a473620c3610b527925e7b5a6ae696b01632
Opcode Fuzzy Hash: f6967d108f3b71c995da1153c54bfbbbd78574a52a3cc597769a049e7cdf8063
Instruction Fuzzy Hash: 49310A76609F818AEB609F64E8443EA7370FB88784F44543ADB4E47B98DF38D5488710

Function 00007FF8B93C6344 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CRYPTO_memcmp.LIBCRYPTO-3 ref: 00007FF8B93C6364

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: O_memcmp
String ID:
API String ID: 2788248766-0
Opcode ID: f8e9c1bd40b32b5c2717bccf2345a97ef4fa6539e5d9bd7d0ddd4693da1b61dd
Instruction ID: f56d906b5fbb97150cd3d0f453f9f4784f2d07b11c54afbb9279ed212809726a
Opcode Fuzzy Hash: f8e9c1bd40b32b5c2717bccf2345a97ef4fa6539e5d9bd7d0ddd4693da1b61dd
Instruction Fuzzy Hash: D9D0C252F1578943CE0CC7ABBE804A891529BACBD074D8035AE0E83B65C82CC8D04500

Function 00007FF8B8CD39D0 Relevance: 73.8, APIs: 30, Strings: 12, Instructions: 293stringmemoryCOMMON

Download Yara Rule

APIs

_PyType_CalculateMetaclass.PYTHON312 ref: 00007FF8B8CD3A3F
PyObject_GetAttrString.PYTHON312 ref: 00007FF8B8CD3A68
PyErr_Clear.PYTHON312 ref: 00007FF8B8CD3A76
PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FF8B8CD3A8E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B8CD3AA6
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B8CD3AB9
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B8CD3ACC
PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FF8B8CD3AE4
PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FF8B8CD3B11
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD3B64
PyErr_SetString.PYTHON312 ref: 00007FF8B8CD3B80
PyUnicode_FromString.PYTHON312 ref: 00007FF8B8CD3B93
PyType_GenericAlloc.PYTHON312 ref: 00007FF8B8CD3BAE
PyObject_SetAttrString.PYTHON312 ref: 00007FF8B8CD3C3B
PyType_Ready.PYTHON312 ref: 00007FF8B8CD3C8A
PyObject_GetAttrString.PYTHON312 ref: 00007FF8B8CD3CAD
PyObject_IsTrue.PYTHON312 ref: 00007FF8B8CD3CC2
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD3CD7
PyErr_SetString.PYTHON312 ref: 00007FF8B8CD3CF2
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD3D06
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD3D1F
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD3D39
PyErr_Clear.PYTHON312 ref: 00007FF8B8CD3D62
PyObject_SetAttrString.PYTHON312 ref: 00007FF8B8CD3D77
_PyObject_FastCall.PYTHON312 ref: 00007FF8B8CD3DA1
_PyObject_GetAttrId.PYTHON312 ref: 00007FF8B8CD3DBD
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD3DD3
PyObject_VectorcallDict.PYTHON312 ref: 00007FF8B8CD3DED
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD3E05
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD3E21

Strings

mypyc classes can't have __slots__, xrefs: 00007FF8B8CD3CE8
__slots__, xrefs: 00007FF8B8CD3C9F
TypingMeta, xrefs: 00007FF8B8CD3A9C
__orig_bases__, xrefs: 00007FF8B8CD3C31
typing_extensions, xrefs: 00007FF8B8CD3ADA
__module__, xrefs: 00007FF8B8CD3A5E, 00007FF8B8CD3D6D
GenericMeta, xrefs: 00007FF8B8CD3AAF
mypyc classes can't have a metaclass, xrefs: 00007FF8B8CD3B76
ABCMeta, xrefs: 00007FF8B8CD3B1F
typing, xrefs: 00007FF8B8CD3A81
_ProtocolMeta, xrefs: 00007FF8B8CD3AC2, 00007FF8B8CD3AF2
abc, xrefs: 00007FF8B8CD3B07

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: String$DeallocObject_$Attr$Err_Unicode_$CompareType_Withstrcmp$Clear$AllocCalculateCallDictFastFromGenericMetaclassReadyTrueVectorcall
String ID: ABCMeta$GenericMeta$TypingMeta$_ProtocolMeta$__module__$__orig_bases__$__slots__$abc$mypyc classes can't have __slots__$mypyc classes can't have a metaclass$typing$typing_extensions
API String ID: 3039355408-3015203947
Opcode ID: 581e7a51ebe161312cd1d03399a5527e61c6b6fd9e8a3dc5876b46a657a736b2
Instruction ID: fe4f1de8c036d6a24dc08bc3535e43df845a06a6108d9363c8861c6ab8997ee9
Opcode Fuzzy Hash: 581e7a51ebe161312cd1d03399a5527e61c6b6fd9e8a3dc5876b46a657a736b2
Instruction Fuzzy Hash: C3D16EA6A09B4682EBB19F2DA96C27923A0BF45BC5F444035CF1D46654EF3CF842CB08

Function 00007FF8B8B327C0 Relevance: 73.7, APIs: 12, Strings: 30, Instructions: 229COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FF8B8B327D7
PyTuple_New.PYTHON312 ref: 00007FF8B8B327E2
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B32804
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B32820
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B3283C
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B32858

Part of subcall function 00007FF8B8B32BA4: PyLong_FromLongLong.PYTHON312(?,?,?,00007FF8B8B32878), ref: 00007FF8B8B32BBC
Part of subcall function 00007FF8B8B32BA4: PyModule_AddObject.PYTHON312(?,?,?,00007FF8B8B32878), ref: 00007FF8B8B32BD3

PyErr_NewExceptionWithDoc.PYTHON312 ref: 00007FF8B8B32B09
PyModule_AddType.PYTHON312 ref: 00007FF8B8B32B22
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FF8B8B32B39
PyModule_AddType.PYTHON312 ref: 00007FF8B8B32B4D
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FF8B8B32B64
PyModule_AddType.PYTHON312 ref: 00007FF8B8B32B79

Strings

FORMAT_XZ, xrefs: 00007FF8B8B32819
MF_BT4, xrefs: 00007FF8B8B32A73
FILTER_IA64, xrefs: 00007FF8B8B32981
CHECK_CRC64, xrefs: 00007FF8B8B328A4
MODE_NORMAL, xrefs: 00007FF8B8B32AA9
FORMAT_ALONE, xrefs: 00007FF8B8B32835
Call to liblzma failed., xrefs: 00007FF8B8B32AF8
FILTER_POWERPC, xrefs: 00007FF8B8B329ED
CHECK_CRC32, xrefs: 00007FF8B8B32887
FILTER_DELTA, xrefs: 00007FF8B8B3294C
FILTER_LZMA1, xrefs: 00007FF8B8B32913
FILTER_ARM, xrefs: 00007FF8B8B3299C
MF_BT3, xrefs: 00007FF8B8B32A58
CHECK_SHA256, xrefs: 00007FF8B8B328BF
MODE_FAST, xrefs: 00007FF8B8B32A8E
PRESET_EXTREME, xrefs: 00007FF8B8B32ADE
CHECK_UNKNOWN, xrefs: 00007FF8B8B328F5
MF_HC3, xrefs: 00007FF8B8B32A08
MF_HC4, xrefs: 00007FF8B8B32A1F
FILTER_SPARC, xrefs: 00007FF8B8B329D2
FORMAT_AUTO, xrefs: 00007FF8B8B327FA
FILTER_LZMA2, xrefs: 00007FF8B8B32931
CHECK_NONE, xrefs: 00007FF8B8B32869
CHECK_ID_MAX, xrefs: 00007FF8B8B328DA
FORMAT_RAW, xrefs: 00007FF8B8B32851
FILTER_X86, xrefs: 00007FF8B8B32963
_lzma.LZMAError, xrefs: 00007FF8B8B32B02
FILTER_ARMTHUMB, xrefs: 00007FF8B8B329B7
PRESET_DEFAULT, xrefs: 00007FF8B8B32AC4
MF_BT2, xrefs: 00007FF8B8B32A3D

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Module_$Constant$FromType$LongModuleSpecType_$Err_ExceptionLong_ObjectStateTuple_With
String ID: CHECK_CRC32$CHECK_CRC64$CHECK_ID_MAX$CHECK_NONE$CHECK_SHA256$CHECK_UNKNOWN$Call to liblzma failed.$FILTER_ARM$FILTER_ARMTHUMB$FILTER_DELTA$FILTER_IA64$FILTER_LZMA1$FILTER_LZMA2$FILTER_POWERPC$FILTER_SPARC$FILTER_X86$FORMAT_ALONE$FORMAT_AUTO$FORMAT_RAW$FORMAT_XZ$MF_BT2$MF_BT3$MF_BT4$MF_HC3$MF_HC4$MODE_FAST$MODE_NORMAL$PRESET_DEFAULT$PRESET_EXTREME$_lzma.LZMAError
API String ID: 2322464913-730042774
Opcode ID: 16902ff4c441b58d46183b5221af345b25057bea0b569c898dc3f7b5c911b51e
Instruction ID: 27f4b89f82fd8021b78fdb414c2d191104f342d8c46f3285b578d084d53591fe
Opcode Fuzzy Hash: 16902ff4c441b58d46183b5221af345b25057bea0b569c898dc3f7b5c911b51e
Instruction Fuzzy Hash: 00A1E521B98E2362F6149F3EAA412A97365AF09BC5F804030CF1D87665EF6DF50AC719

Function 00007FF8B8CD13E0 Relevance: 60.0, APIs: 20, Strings: 14, Instructions: 491stringCOMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON312 ref: 00007FF8B8CD1574
strchr.VCRUNTIME140 ref: 00007FF8B8CD15CE
_PyDict_GetItemStringWithError.PYTHON312 ref: 00007FF8B8CD16F5
PyErr_Occurred.PYTHON312 ref: 00007FF8B8CD1738
PyErr_Format.PYTHON312 ref: 00007FF8B8CD1852
PyErr_Format.PYTHON312 ref: 00007FF8B8CD1891
PyTuple_GetSlice.PYTHON312 ref: 00007FF8B8CD18E8
PyErr_Format.PYTHON312 ref: 00007FF8B8CD196F
PyDict_New.PYTHON312 ref: 00007FF8B8CD19E4
_PyDict_GetItemStringWithError.PYTHON312 ref: 00007FF8B8CD1A18
PyErr_Occurred.PYTHON312 ref: 00007FF8B8CD1A27
PyDict_Next.PYTHON312 ref: 00007FF8B8CD1A70
_PyUnicode_EqualToASCIIString.PYTHON312 ref: 00007FF8B8CD1AA8
PyDict_SetItem.PYTHON312 ref: 00007FF8B8CD1ADE
PyDict_Next.PYTHON312 ref: 00007FF8B8CD1B07
PyErr_Format.PYTHON312 ref: 00007FF8B8CD1B62
PyErr_Format.PYTHON312 ref: 00007FF8B8CD1BAB
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD1BF1
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD1C1F

Strings

at most, xrefs: 00007FF8B8CD164D
%.200s%s missing required argument '%s' (pos %d), xrefs: 00007FF8B8CD1869
keyword , xrefs: 00007FF8B8CD1519
%.200s%s missing required keyword-only argument '%s', xrefs: 00007FF8B8CD182C
keywords must be strings, xrefs: 00007FF8B8CD1BBA
%.200s%s takes no positional arguments, xrefs: 00007FF8B8CD1950
%.200s%s takes %s %d positional argument%s (%zd given), xrefs: 00007FF8B8CD167E, 00007FF8B8CD19D4
%.200s%s takes at most %d %sargument%s (%zd given), xrefs: 00007FF8B8CD1555
exactly, xrefs: 00007FF8B8CD165F, 00007FF8B8CD19A9
function, xrefs: 00007FF8B8CD1563, 00007FF8B8CD1841, 00007FF8B8CD1880, 00007FF8B8CD195E, 00007FF8B8CD1B4C
this function, xrefs: 00007FF8B8CD1B79
argument for %.200s%s given by name ('%s') and position (%d), xrefs: 00007FF8B8CD1B3A
at least, xrefs: 00007FF8B8CD1997
'%U' is an invalid keyword argument for %.200s%s, xrefs: 00007FF8B8CD1BA1

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_$Dict_Format$ItemString$DeallocErrorNextOccurredWith$EqualSliceTuple_Unicode_strchr
String ID: %.200s%s missing required argument '%s' (pos %d)$%.200s%s missing required keyword-only argument '%s'$%.200s%s takes %s %d positional argument%s (%zd given)$%.200s%s takes at most %d %sargument%s (%zd given)$%.200s%s takes no positional arguments$'%U' is an invalid keyword argument for %.200s%s$argument for %.200s%s given by name ('%s') and position (%d)$at least$at most$exactly$function$keyword $keywords must be strings$this function
API String ID: 3559638176-2999033026
Opcode ID: 1f8ef507af8cc2a236b28dc01e6daa758a540280c688015cb7e3079141fe9442
Instruction ID: 552e9ccb62f06d967bb8cc3a1d0f4ad17c9c519c700fa1d2d97d722408be26f6
Opcode Fuzzy Hash: 1f8ef507af8cc2a236b28dc01e6daa758a540280c688015cb7e3079141fe9442
Instruction Fuzzy Hash: B43271B1A09B8686EBB09F09E4682A9B3A0FB44BC5F545036DB4D47768DF3CE446CB04

Function 00007FF8B8CD2150 Relevance: 45.9, APIs: 13, Strings: 13, Instructions: 440COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON312 ref: 00007FF8B8CD22E2
PyErr_Format.PYTHON312 ref: 00007FF8B8CD236F
PyTuple_New.PYTHON312 ref: 00007FF8B8CD24A4
PyErr_Format.PYTHON312 ref: 00007FF8B8CD25EA
PyErr_Format.PYTHON312 ref: 00007FF8B8CD261D
PyDict_New.PYTHON312 ref: 00007FF8B8CD2628
_PyUnicode_EQ.PYTHON312 ref: 00007FF8B8CD26A6
PySequence_Contains.PYTHON312 ref: 00007FF8B8CD273B
PyDict_SetItem.PYTHON312 ref: 00007FF8B8CD2759
PyErr_Format.PYTHON312 ref: 00007FF8B8CD27B2
PyErr_Format.PYTHON312 ref: 00007FF8B8CD27F7
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD281A
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD284D

Strings

argument for %.200s%s given by name ('%U') and position (%d), xrefs: 00007FF8B8CD278B
%.200s%s missing required argument '%U' (pos %d), xrefs: 00007FF8B8CD260F
'%S' is an invalid keyword argument for %.200s%s, xrefs: 00007FF8B8CD27DD
at most, xrefs: 00007FF8B8CD2322
keyword , xrefs: 00007FF8B8CD2264
%.200s%s takes no positional arguments, xrefs: 00007FF8B8CD22D0
%.200s%s missing required keyword-only argument '%U', xrefs: 00007FF8B8CD25D1
%.200s%s takes %s %d positional argument%s (%zd given), xrefs: 00007FF8B8CD234D
%.200s%s takes at most %d %sargument%s (%zd given), xrefs: 00007FF8B8CD226B
exactly, xrefs: 00007FF8B8CD2329, 00007FF8B8CD2575
function, xrefs: 00007FF8B8CD224C, 00007FF8B8CD22BF, 00007FF8B8CD230D, 00007FF8B8CD254F, 00007FF8B8CD25A3, 00007FF8B8CD277A
this function, xrefs: 00007FF8B8CD27D6
at least, xrefs: 00007FF8B8CD2564

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_Format$DeallocDict_$ContainsItemSequence_Tuple_Unicode_
String ID: %.200s%s missing required argument '%U' (pos %d)$%.200s%s missing required keyword-only argument '%U'$%.200s%s takes %s %d positional argument%s (%zd given)$%.200s%s takes at most %d %sargument%s (%zd given)$%.200s%s takes no positional arguments$'%S' is an invalid keyword argument for %.200s%s$argument for %.200s%s given by name ('%U') and position (%d)$at least$at most$exactly$function$keyword $this function
API String ID: 3590232122-3030676885
Opcode ID: 1ff9da88f9a7a57dac390b6711fe79e0e012da9bfee1266b6d806b6e39d40ce2
Instruction ID: c0aac535f58056a530f7e4e66fcda05af5103fa9e4fbc7ac87eb3a6dbb6ef97a
Opcode Fuzzy Hash: 1ff9da88f9a7a57dac390b6711fe79e0e012da9bfee1266b6d806b6e39d40ce2
Instruction Fuzzy Hash: D5125EB2609B8692DBB19F49E8686A973A4FB44BC5F444036EB5D43764DF3CF442CB08

Function 00007FF8B8CDB980 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 367COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B8CD2920: PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD2961
Part of subcall function 00007FF8B8CD2920: PyNumber_Add.PYTHON312 ref: 00007FF8B8CD29B7
Part of subcall function 00007FF8B8CD2920: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD29D7
Part of subcall function 00007FF8B8CD2920: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD29EB

PyObject_VectorcallMethod.PYTHON312 ref: 00007FF8B8CDB9E5
PyObject_Vectorcall.PYTHON312 ref: 00007FF8B8CDBAB7
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDBACE
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDBB13
PyType_IsSubtype.PYTHON312 ref: 00007FF8B8CDBB77
PySet_Contains.PYTHON312 ref: 00007FF8B8CDBB99
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDBBAF

Part of subcall function 00007FF8B8CD34A0: PyDict_GetItemWithError.PYTHON312 ref: 00007FF8B8CD34BB
Part of subcall function 00007FF8B8CD34A0: PyErr_Occurred.PYTHON312 ref: 00007FF8B8CD34C9
Part of subcall function 00007FF8B8CD34A0: PyErr_SetObject.PYTHON312 ref: 00007FF8B8CD34E1

PyObject_Vectorcall.PYTHON312 ref: 00007FF8B8CDBC24
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDBC3B
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDBC7C
PyObject_Vectorcall.PYTHON312 ref: 00007FF8B8CDBD0F
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDBD26

Part of subcall function 00007FF8B8CD3880: PyThreadState_Get.PYTHON312 ref: 00007FF8B8CD38A2
Part of subcall function 00007FF8B8CD3880: PyErr_Fetch.PYTHON312 ref: 00007FF8B8CD38BA
Part of subcall function 00007FF8B8CD3880: PyCode_NewEmpty.PYTHON312 ref: 00007FF8B8CD38CD
Part of subcall function 00007FF8B8CD3880: PyFrame_New.PYTHON312 ref: 00007FF8B8CD38E7
Part of subcall function 00007FF8B8CD3880: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD3902
Part of subcall function 00007FF8B8CD3880: _PyErr_ChainExceptions1.PYTHON312 ref: 00007FF8B8CD390D

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDBA4D

Part of subcall function 00007FF8B8CD3800: PyErr_Format.PYTHON312 ref: 00007FF8B8CD3834

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDBF1D

Strings

str or None, xrefs: 00007FF8B8CDBCA0, 00007FF8B8CDBD4A
str, xrefs: 00007FF8B8CDBEDC
feed, xrefs: 00007FF8B8CDB9FA, 00007FF8B8CDBA84, 00007FF8B8CDBB4E, 00007FF8B8CDBC4D, 00007FF8B8CDBCD4, 00007FF8B8CDBD61, 00007FF8B8CDBDDA, 00007FF8B8CDBE75, 00007FF8B8CDBEEE
bool, xrefs: 00007FF8B8CDBA23, 00007FF8B8CDBAE9, 00007FF8B8CDBE3B
set, xrefs: 00007FF8B8CDBB81

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Err_$Object_Vectorcall$ChainCode_ContainsDict_EmptyErrorExceptions1FetchFormatFrame_FromItemLong_MethodNumber_ObjectOccurredSet_Ssize_tState_SubtypeThreadType_With
String ID: bool$feed$set$str$str or None
API String ID: 2120016896-82482222
Opcode ID: e10df2e8b84fc016c60972893c28a7248685ceeda9d69689395281560c33c246
Instruction ID: 39222e252e1e9f939d61713d87617b0538849f6cb83eeecdefaa6e9125cc9b01
Opcode Fuzzy Hash: e10df2e8b84fc016c60972893c28a7248685ceeda9d69689395281560c33c246
Instruction Fuzzy Hash: 0F023EB5A0864286EBF0AF1DE9682B963A0AF44BD5F444035DB5D07A99DF3CF446CB08

Function 00007FF8B8CDAE50 Relevance: 44.1, APIs: 22, Strings: 3, Instructions: 384COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B8CD2920: PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD2961
Part of subcall function 00007FF8B8CD2920: PyNumber_Add.PYTHON312 ref: 00007FF8B8CD29B7
Part of subcall function 00007FF8B8CD2920: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD29D7
Part of subcall function 00007FF8B8CD2920: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD29EB

PyObject_Vectorcall.PYTHON312 ref: 00007FF8B8CDAEFA
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDAF11
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDAF56
PyObject_Vectorcall.PYTHON312 ref: 00007FF8B8CDAFBE
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDAFD5
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDB016
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDB054
PyObject_VectorcallMethod.PYTHON312 ref: 00007FF8B8CDB0AF
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDB117
PyObject_VectorcallMethod.PYTHON312 ref: 00007FF8B8CDB15D

Part of subcall function 00007FF8B8CD3880: PyThreadState_Get.PYTHON312 ref: 00007FF8B8CD38A2
Part of subcall function 00007FF8B8CD3880: PyErr_Fetch.PYTHON312 ref: 00007FF8B8CD38BA
Part of subcall function 00007FF8B8CD3880: PyCode_NewEmpty.PYTHON312 ref: 00007FF8B8CD38CD
Part of subcall function 00007FF8B8CD3880: PyFrame_New.PYTHON312 ref: 00007FF8B8CD38E7
Part of subcall function 00007FF8B8CD3880: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD3902
Part of subcall function 00007FF8B8CD3880: _PyErr_ChainExceptions1.PYTHON312 ref: 00007FF8B8CD390D

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDB3F3

Strings

str, xrefs: 00007FF8B8CDB426, 00007FF8B8CDB45E
feed, xrefs: 00007FF8B8CDAEC7, 00007FF8B8CDAFE7, 00007FF8B8CDB066, 00007FF8B8CDB0C4, 00007FF8B8CDB172, 00007FF8B8CDB2F5, 00007FF8B8CDB39E, 00007FF8B8CDB433, 00007FF8B8CDB46A
bool, xrefs: 00007FF8B8CDAF2C, 00007FF8B8CDB02C, 00007FF8B8CDB0ED, 00007FF8B8CDB1B7

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Object_Vectorcall$Err_Method$ChainCode_EmptyExceptions1FetchFrame_FromLong_Number_Ssize_tState_Thread
String ID: bool$feed$str
API String ID: 476165880-2613659865
Opcode ID: 7f2e8c55a4eeca045cf774529f01804e1fee1cd08f798284cff5715901533d5d
Instruction ID: ca32ff2b6a790d7bd0b6c72baab62e6bcd84001c1878636304d182827ef07596
Opcode Fuzzy Hash: 7f2e8c55a4eeca045cf774529f01804e1fee1cd08f798284cff5715901533d5d
Instruction Fuzzy Hash: 27024FB6A0964282EBF0AF1DE96C2B92391AF447C5F445035DB5D07A99DF3CF442CB48

Function 00007FF8B8CD9740 Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B8CD2920: PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD2961
Part of subcall function 00007FF8B8CD2920: PyNumber_Add.PYTHON312 ref: 00007FF8B8CD29B7
Part of subcall function 00007FF8B8CD2920: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD29D7
Part of subcall function 00007FF8B8CD2920: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD29EB

PyObject_RichCompare.PYTHON312 ref: 00007FF8B8CD978F
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD97A6
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD97F6
PyType_IsSubtype.PYTHON312 ref: 00007FF8B8CD9841
PySet_Contains.PYTHON312 ref: 00007FF8B8CD9884
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD989A
PyObject_Vectorcall.PYTHON312 ref: 00007FF8B8CD98E8
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD98FF
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD9944
PyObject_VectorcallMethod.PYTHON312 ref: 00007FF8B8CD997B
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD9BE5

Part of subcall function 00007FF8B8CD3800: PyErr_Format.PYTHON312 ref: 00007FF8B8CD3834

Strings

feed, xrefs: 00007FF8B8CD9862, 00007FF8B8CD9B4C
bool, xrefs: 00007FF8B8CD97CC, 00007FF8B8CD991A, 00007FF8B8CD99A4, 00007FF8B8CD9A65, 00007FF8B8CD9B09
set, xrefs: 00007FF8B8CD984B

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Object_$Vectorcall$CompareContainsErr_FormatFromLong_MethodNumber_RichSet_Ssize_tSubtypeType_
String ID: bool$feed$set
API String ID: 588643045-561237756
Opcode ID: 2ce494273f180fa024b86351a584eddda6a252b5bae88b763fbfbb79a573f59b
Instruction ID: c649b77fff24f05f7780ef72304ee9d297137c832794df313e14f0c12923d769
Opcode Fuzzy Hash: 2ce494273f180fa024b86351a584eddda6a252b5bae88b763fbfbb79a573f59b
Instruction Fuzzy Hash: 28D122B5A0860282EBF1AF1DE87927563D1AF44BD5F454035CB1D06AA9DF3DF846CB08

Function 00007FF8B93C1E40 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 162COMMON

Download Yara Rule

APIs

PyUnicode_AsUTF8AndSize.PYTHON312 ref: 00007FF8B93C1F27
PyObject_GetBuffer.PYTHON312 ref: 00007FF8B93C1F60
PyBuffer_IsContiguous.PYTHON312 ref: 00007FF8B93C1F75
PyObject_GetBuffer.PYTHON312 ref: 00007FF8B93C1F92
PyBuffer_IsContiguous.PYTHON312 ref: 00007FF8B93C1FA6
PyLong_AsLong.PYTHON312 ref: 00007FF8B93C1FC0
PyBuffer_Release.PYTHON312 ref: 00007FF8B93C203B
PyBuffer_Release.PYTHON312 ref: 00007FF8B93C2054
_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B93C20B5
_PyArg_BadArgument.PYTHON312 ref: 00007FF8B93C20E4
PyErr_Occurred.PYTHON312 ref: 00007FF8B93C20EF

Strings

contiguous buffer, xrefs: 00007FF8B93C4FB9, 00007FF8B93C4FDE
argument 'salt', xrefs: 00007FF8B93C4FE5
embedded null character, xrefs: 00007FF8B93C4F9F
str, xrefs: 00007FF8B93C20CF
argument 'hash_name', xrefs: 00007FF8B93C20DD
argument 'password', xrefs: 00007FF8B93C4FC0
pbkdf2_hmac, xrefs: 00007FF8B93C20D6, 00007FF8B93C4FC7, 00007FF8B93C4FEC

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Buffer_$Arg_BufferContiguousObject_Release$ArgumentErr_KeywordsLongLong_OccurredSizeUnicode_Unpack
String ID: argument 'hash_name'$argument 'password'$argument 'salt'$contiguous buffer$embedded null character$pbkdf2_hmac$str
API String ID: 448224016-2023054051
Opcode ID: 69e9f00f44b3f40f86fb55869f68b83c8c910e31a01b11ab5bae36c867e4943d
Instruction ID: 6d45f632cfac4d40fbc1eab1aaae3111d8db2821208a4688bb0835f7aa035630
Opcode Fuzzy Hash: 69e9f00f44b3f40f86fb55869f68b83c8c910e31a01b11ab5bae36c867e4943d
Instruction Fuzzy Hash: 7B81FB22A18FC681EA608F19E8443BA6371FB9D7D4F446236DF8D46665DF3CE549C700

Function 00007FF8B8CD1D70 Relevance: 35.2, APIs: 10, Strings: 10, Instructions: 216stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,00007FF8B8CD21A1), ref: 00007FF8B8CD1E19

Strings

%, xrefs: 00007FF8B8CD1DF6
more argument specifiers than keyword list entries (remaining format:'%s'), xrefs: 00007FF8B8CD1F69
Empty parameter name after $, xrefs: 00007FF8B8CD1F95
Invalid format string (@ specified twice), xrefs: 00007FF8B8CD1FB0
Invalid format string ($ before |), xrefs: 00007FF8B8CD1F83
Invalid format string ($ specified twice), xrefs: 00007FF8B8CD1F9E
More keyword list entries (%d) than format specifiers (%d), xrefs: 00007FF8B8CD1FD5
Invalid format string (@ without preceding | and $), xrefs: 00007FF8B8CD1FA7
Empty keyword parameter name, xrefs: 00007FF8B8CD1E3C
Invalid format string (| specified twice), xrefs: 00007FF8B8CD1F8C

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: strchr
String ID: %$Empty keyword parameter name$Empty parameter name after $$Invalid format string ($ before |)$Invalid format string ($ specified twice)$Invalid format string (@ specified twice)$Invalid format string (@ without preceding | and $)$Invalid format string (| specified twice)$More keyword list entries (%d) than format specifiers (%d)$more argument specifiers than keyword list entries (remaining format:'%s')
API String ID: 2830005266-262724644
Opcode ID: 38c6c7fd6f791c59d1b5912cc3173f5b2923cab9302d414a8e120c7176cfda89
Instruction ID: 28b44ec0d0d59b5af3bc1b8a901d9c458254f4a4129525d3adf1b931173ba064
Opcode Fuzzy Hash: 38c6c7fd6f791c59d1b5912cc3173f5b2923cab9302d414a8e120c7176cfda89
Instruction Fuzzy Hash: 6091A4B1A09A4282EBB49B18E468138B3E1FB48BD5F545136CB5D47B98DF3CF852C708

Function 00007FF8B93C5794 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FF8B93C57B9
PyBool_FromLong.PYTHON312 ref: 00007FF8B93C59AB

Strings

Buffer must be single dimension, xrefs: 00007FF8B93C5902, 00007FF8B93C594B
unsupported operand types(s) or combination of types: '%.100s' and '%.100s', xrefs: 00007FF8B93C58B4
compare_digest, xrefs: 00007FF8B93C57AC
comparing strings with non-ASCII characters is not supported, xrefs: 00007FF8B93C587F

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Arg_Bool_CheckFromLongPositional
String ID: Buffer must be single dimension$compare_digest$comparing strings with non-ASCII characters is not supported$unsupported operand types(s) or combination of types: '%.100s' and '%.100s'
API String ID: 2366872897-2538118963
Opcode ID: 6a5880c52000b7ec7c64fdb1128536a05dc2275c5edf08b1b1a49cd47ecd3df0
Instruction ID: 1fc0ff14c9f2c5c337f2fcbf682c7b16f04b1efaff87d2f6d896cd7bf711fcec
Opcode Fuzzy Hash: 6a5880c52000b7ec7c64fdb1128536a05dc2275c5edf08b1b1a49cd47ecd3df0
Instruction Fuzzy Hash: 54510766A0DF8692EB608F2AE85577A6371FB4CBC4F546032DF4E476A4DE2CE548C700

Function 00007FF8B93C1000 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 125threadCOMMON

Download Yara Rule

APIs

PyObject_CheckBuffer.PYTHON312 ref: 00007FF8B93C1024
PyObject_GetBuffer.PYTHON312 ref: 00007FF8B93C103D
PyEval_SaveThread.PYTHON312 ref: 00007FF8B93C1081
PyThread_acquire_lock.PYTHON312 ref: 00007FF8B93C1093
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FF8B93C10C3
PyThread_release_lock.PYTHON312 ref: 00007FF8B93C10E2
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B93C10EB
PyBuffer_Release.PYTHON312 ref: 00007FF8B93C10FE
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FF8B93C1163
PyThread_allocate_lock.PYTHON312 ref: 00007FF8B93C1183
PyErr_SetString.PYTHON312 ref: 00007FF8B93C4C92
PyErr_SetString.PYTHON312 ref: 00007FF8B93C4CB0
PyBuffer_Release.PYTHON312 ref: 00007FF8B93C4CBB

Strings

Buffer must be single dimension, xrefs: 00007FF8B93C4CA6
Strings must be encoded before hashing, xrefs: 00007FF8B93C4C78
object supporting the buffer API required, xrefs: 00007FF8B93C4C81

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: BufferBuffer_DigestErr_Eval_Object_ReleaseStringThreadUpdate$CheckRestoreSaveThread_acquire_lockThread_allocate_lockThread_release_lock
String ID: Buffer must be single dimension$Strings must be encoded before hashing$object supporting the buffer API required
API String ID: 3306358805-2943709887
Opcode ID: ffa78fb9cf0e13fd5266a17905d514e66aac14ddf2671b6f9e39819078df0c1c
Instruction ID: b99b52bc84c1250b2e68c954f83bb503d8da590da8f6981483a7ff0b5fed1028
Opcode Fuzzy Hash: ffa78fb9cf0e13fd5266a17905d514e66aac14ddf2671b6f9e39819078df0c1c
Instruction Fuzzy Hash: D7512D25B18FC285EA609F2AD84427A63B0BB8CBD4F58A131DF5E477B4DF2CE4499740

Function 00007FF8B93C2110 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B93C2280: PyModule_GetState.PYTHON312(?,?,00000000,00007FF8B93C2131), ref: 00007FF8B93C229A
Part of subcall function 00007FF8B93C2280: _Py_hashtable_get.PYTHON312(?,?,00000000,00007FF8B93C2131), ref: 00007FF8B93C22AA
Part of subcall function 00007FF8B93C2280: EVP_MD_up_ref.LIBCRYPTO-3(?,?,00000000,00007FF8B93C2131), ref: 00007FF8B93C22CD

EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF8B93C218E
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FF8B93C21A4
PyEval_SaveThread.PYTHON312 ref: 00007FF8B93C21B7
PKCS5_PBKDF2_HMAC.LIBCRYPTO-3 ref: 00007FF8B93C21E7
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B93C21F2
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B93C2212
PyLong_AsLong.PYTHON312 ref: 00007FF8B93C222A
PyErr_Occurred.PYTHON312 ref: 00007FF8B93C223B
PyErr_SetString.PYTHON312 ref: 00007FF8B93C2257
PyErr_SetString.PYTHON312 ref: 00007FF8B93C2270
PyErr_SetString.PYTHON312 ref: 00007FF8B93C501A
_Py_Dealloc.PYTHON312 ref: 00007FF8B93C5035

Strings

salt is too long., xrefs: 00007FF8B93C5009
iteration value must be greater than 0., xrefs: 00007FF8B93C2266
password is too long., xrefs: 00007FF8B93C5000
key length must be greater than 0., xrefs: 00007FF8B93C224D

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String$Eval_Thread$Bytes_D_freeD_get_sizeD_up_refDeallocFromLongLong_Module_OccurredPy_hashtable_getRestoreSaveSizeState
String ID: iteration value must be greater than 0.$key length must be greater than 0.$password is too long.$salt is too long.
API String ID: 1537479992-530160643
Opcode ID: 437a8a75218f0fcc15b65f7c515ceab8e3b54216f4037f06213bc29d05337a50
Instruction ID: 64a4f94b5a9018160aa9186df1360524246909edb337ca2a6a853b54a05a62f8
Opcode Fuzzy Hash: 437a8a75218f0fcc15b65f7c515ceab8e3b54216f4037f06213bc29d05337a50
Instruction Fuzzy Hash: 0D412536A08F8286EA509F2AE48413A23B0FB8DBD4F156131DF5E837A4DF3CE5098740

Function 00007FF8B93C61CC Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 86threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B93C6219
PyObject_CheckBuffer.PYTHON312 ref: 00007FF8B93C6229
PyObject_GetBuffer.PYTHON312 ref: 00007FF8B93C6247
PyErr_SetString.PYTHON312 ref: 00007FF8B93C626A
PyBuffer_Release.PYTHON312 ref: 00007FF8B93C6275
PyThread_allocate_lock.PYTHON312 ref: 00007FF8B93C6299
PyEval_SaveThread.PYTHON312 ref: 00007FF8B93C62A8
PyThread_acquire_lock.PYTHON312 ref: 00007FF8B93C62BA
HMAC_Update.LIBCRYPTO-3 ref: 00007FF8B93C62CE
PyThread_release_lock.PYTHON312 ref: 00007FF8B93C62DA
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B93C62E3
HMAC_Update.LIBCRYPTO-3 ref: 00007FF8B93C62F9
PyBuffer_Release.PYTHON312 ref: 00007FF8B93C6306

Strings

Buffer must be single dimension, xrefs: 00007FF8B93C6260
Strings must be encoded before hashing, xrefs: 00007FF8B93C6208
object supporting the buffer API required, xrefs: 00007FF8B93C6233

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: BufferBuffer_Err_Eval_Object_ReleaseStringThreadUpdate$CheckRestoreSaveThread_acquire_lockThread_allocate_lockThread_release_lock
String ID: Buffer must be single dimension$Strings must be encoded before hashing$object supporting the buffer API required
API String ID: 2508703043-2943709887
Opcode ID: 97376add66b81b713f2618c5b33b7a207359033775c0f28a1d481802927d64a2
Instruction ID: 9dff6a43afabb63e805225a7180d1d88dc8d28f32df0d8c3e5451d1c0c32341a
Opcode Fuzzy Hash: 97376add66b81b713f2618c5b33b7a207359033775c0f28a1d481802927d64a2
Instruction Fuzzy Hash: 9A410022A18FC282EA609F19E85427A6770FB9CBC8F146131EF4F43674DF2DE5988740

Function 00007FF8B8B271F0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 156threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312 ref: 00007FF8B8B27217
PyThread_allocate_lock.PYTHON312 ref: 00007FF8B8B2728A
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FF8B8B272CA
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B2736B
PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FF8B8B27389
PyErr_Occurred.PYTHON312 ref: 00007FF8B8B27392
PyErr_SetString.PYTHON312 ref: 00007FF8B8B273E0
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B34B1D
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B34B4E

Strings

Must specify filters for FORMAT_RAW, xrefs: 00007FF8B8B34B04
Cannot specify memory limit with FORMAT_RAW, xrefs: 00007FF8B8B273ED
Invalid container format: %d, xrefs: 00007FF8B8B34B61
Unable to allocate lock, xrefs: 00007FF8B8B34B2A
Cannot specify filters except with FORMAT_RAW, xrefs: 00007FF8B8B273CF

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Err_LongString$Bytes_FromLong_ModuleOccurredSizeStateThread_allocate_lockType_Unsigned
String ID: Cannot specify filters except with FORMAT_RAW$Cannot specify memory limit with FORMAT_RAW$Invalid container format: %d$Must specify filters for FORMAT_RAW$Unable to allocate lock
API String ID: 553332449-1518367256
Opcode ID: 83269ee791d243be0076bb43cd9e278918348ca24e3dda33455d90f1b8b1c2f8
Instruction ID: 9835d757ef656bd702eac38f5737f529667b08ebe3fa4d5c7635d394925f6770
Opcode Fuzzy Hash: 83269ee791d243be0076bb43cd9e278918348ca24e3dda33455d90f1b8b1c2f8
Instruction Fuzzy Hash: 20615421A88A42C1EA658F3EA85427D7BA1FF49BD4F888135DF0E06294DF3CE457870D

Function 00007FF8B8B30CAC Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PyMapping_GetItemString.PYTHON312 ref: 00007FF8B8B30CD5
PyMem_Calloc.PYTHON312 ref: 00007FF8B8B30D2C
_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FF8B8B30E12
PyErr_ExceptionMatches.PYTHON312 ref: 00007FF8B8B30E3C
PyErr_Clear.PYTHON312 ref: 00007FF8B8B30E46

Part of subcall function 00007FF8B8B31E7C: PyLong_AsUnsignedLongLong.PYTHON312(?,?,00000006,00007FF8B8B30CFC), ref: 00007FF8B8B31E89
Part of subcall function 00007FF8B8B31E7C: PyErr_Occurred.PYTHON312(?,?,00000006,00007FF8B8B30CFC), ref: 00007FF8B8B31E92

PyErr_SetString.PYTHON312 ref: 00007FF8B8B30E62
PyMem_Free.PYTHON312 ref: 00007FF8B8B30E6B
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B35D46

Strings

Invalid compression preset: %u, xrefs: 00007FF8B8B35D6B
|OOO&O&O&O&O&O&O&O&, xrefs: 00007FF8B8B30DBF
Invalid filter specifier for LZMA filter, xrefs: 00007FF8B8B30E58
preset, xrefs: 00007FF8B8B30CC8

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Err_$LongMem_String$Arg_CallocClearDeallocExceptionFreeItemKeywords_Long_Mapping_MatchesOccurredParseSizeTupleUnsigned
String ID: Invalid compression preset: %u$Invalid filter specifier for LZMA filter$preset$|OOO&O&O&O&O&O&O&O&
API String ID: 1879153319-1461672608
Opcode ID: f4c4c6e41dfebc803be0e4ebb02aeaa3e2e4c228a037d78fce276d899d29ed1e
Instruction ID: c51d9f4902fedb34ebd764a60449a00e1ffb5deb66325f14f63b6751756b330b
Opcode Fuzzy Hash: f4c4c6e41dfebc803be0e4ebb02aeaa3e2e4c228a037d78fce276d899d29ed1e
Instruction Fuzzy Hash: 8951FC35A88B8285EA608F29F8402AA73A4FF88BC4F544135DB9D43B64DF7CE456C745

Function 00007FF8B93C3690 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 109stringCOMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FF8B93C36AB
PyModule_GetDef.PYTHON312 ref: 00007FF8B93C36B7
PyDict_New.PYTHON312 ref: 00007FF8B93C36C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B93C3700
PyUnicode_FromString.PYTHON312 ref: 00007FF8B93C3711
PyObject_GetAttrString.PYTHON312 ref: 00007FF8B93C3729
PyDict_SetItem.PYTHON312 ref: 00007FF8B93C3745
PyDictProxy_New.PYTHON312 ref: 00007FF8B93C3784
PyModule_AddObjectRef.PYTHON312 ref: 00007FF8B93C379F
_Py_Dealloc.PYTHON312 ref: 00007FF8B93C5485
_Py_Dealloc.PYTHON312 ref: 00007FF8B93C54B6

Strings

_constructors, xrefs: 00007FF8B93C3795
openssl_, xrefs: 00007FF8B93C36F6

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Module_$DeallocDict_String$AttrDictFromItemObjectObject_Proxy_StateUnicode_strncmp
String ID: _constructors$openssl_
API String ID: 4222656307-3359357282
Opcode ID: b28a7b8d108d57e302cd9a3016cdfd6d9fb40260b4281184a2b278c249557a5e
Instruction ID: 68e5d6a01713fb61ed19d411d157dcd79e85517ece6a0368d7b637f5d6bb9664
Opcode Fuzzy Hash: b28a7b8d108d57e302cd9a3016cdfd6d9fb40260b4281184a2b278c249557a5e
Instruction Fuzzy Hash: D6410875A0DF8392EA159F2AE85427A22B4EF4DBD1F486035CF0E067A5EF3CE5498340

Function 00007FF8B8CD1060 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

_PyObject_LookupAttrId.PYTHON312 ref: 00007FF8B8CD10BF
PyList_Append.PYTHON312 ref: 00007FF8B8CD10E6
_PyObject_FastCall.PYTHON312 ref: 00007FF8B8CD1104
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD111D
PyList_New.PYTHON312 ref: 00007FF8B8CD1148
PyList_SetSlice.PYTHON312 ref: 00007FF8B8CD118C
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD11A4
PyList_AsTuple.PYTHON312 ref: 00007FF8B8CD11C2
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD11D9
PyErr_SetString.PYTHON312 ref: 00007FF8B8CD11F5
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD1209
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD1222

Strings

__mro_entries__ must return a tuple, xrefs: 00007FF8B8CD11EB

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$List_$Object_$AppendAttrCallErr_FastLookupSliceStringTuple
String ID: __mro_entries__ must return a tuple
API String ID: 1865160900-2385075324
Opcode ID: b039deb2464f2060ae4a0bd026d99ad7f7f16f43939d06b91a08d2db725bb474
Instruction ID: 2254f233f7cc7c144a1924fa27758a14de6491f8488c3b1d6e920d5897781051
Opcode Fuzzy Hash: b039deb2464f2060ae4a0bd026d99ad7f7f16f43939d06b91a08d2db725bb474
Instruction Fuzzy Hash: 7B5170B2A08A42C6EBB4AF19E96C279A3A1FF45BD5F046032CF1D46654DF3DE4438B04

Function 00007FF8B8B281F0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8B8B28245
PyObject_GetBuffer.PYTHON312 ref: 00007FF8B8B28279
PyBuffer_IsContiguous.PYTHON312 ref: 00007FF8B8B2828A
PyBuffer_Release.PYTHON312 ref: 00007FF8B8B282BD
_PyNumber_Index.PYTHON312 ref: 00007FF8B8B282EF
PyLong_AsSsize_t.PYTHON312 ref: 00007FF8B8B28300
_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B8B2835B
PyErr_Occurred.PYTHON312 ref: 00007FF8B8B2837B
_PyArg_BadArgument.PYTHON312 ref: 00007FF8B8B34D3E

Strings

contiguous buffer, xrefs: 00007FF8B8B34D29
argument 'data', xrefs: 00007FF8B8B34D30
decompress, xrefs: 00007FF8B8B34D37

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Arg_Buffer_$ArgumentBufferContiguousErr_IndexKeywordsLong_Number_Object_OccurredReleaseSsize_tUnpackmemset
String ID: argument 'data'$contiguous buffer$decompress
API String ID: 883004049-2667845042
Opcode ID: 88c77d4d997a75998901cae189d6daafd895ebee0202d34df3d556540e27568e
Instruction ID: 1df7c4f55f67826ed365feb02d22b69c7dcd955fdac34a1fb0f60daf3393b6e8
Opcode Fuzzy Hash: 88c77d4d997a75998901cae189d6daafd895ebee0202d34df3d556540e27568e
Instruction Fuzzy Hash: C9419021A58F4282EA118F39E84027D67A0FB49BD1F884131DF5D177A4DF3CE406C708

Function 00007FF8B93C5D80 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B93C5E36
PyObject_GetBuffer.PYTHON312 ref: 00007FF8B93C5E53
PyBuffer_IsContiguous.PYTHON312 ref: 00007FF8B93C5E68
_PyArg_BadArgument.PYTHON312 ref: 00007FF8B93C5E8A
PyObject_GetBuffer.PYTHON312 ref: 00007FF8B93C5EA1
PyBuffer_IsContiguous.PYTHON312 ref: 00007FF8B93C5EB5
_PyArg_BadArgument.PYTHON312 ref: 00007FF8B93C5ED8
PyBuffer_Release.PYTHON312 ref: 00007FF8B93C5F09
PyBuffer_Release.PYTHON312 ref: 00007FF8B93C5F22

Strings

contiguous buffer, xrefs: 00007FF8B93C5E75, 00007FF8B93C5EC3
argument 'key', xrefs: 00007FF8B93C5E7C
argument 'msg', xrefs: 00007FF8B93C5ECA
hmac_digest, xrefs: 00007FF8B93C5E83, 00007FF8B93C5ED1

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Buffer_$Arg_$ArgumentBufferContiguousObject_Release$KeywordsUnpack
String ID: argument 'key'$argument 'msg'$contiguous buffer$hmac_digest
API String ID: 3345984100-3409375717
Opcode ID: fb41b6aa0cae3f82317e0c6388428b0fd7fa67f7124ca0d72b61217752ca230b
Instruction ID: 8127e73ba36c05e9ca6c7655b36bf73a5112e77a21ecdcc96e77cc85ae5ae2c8
Opcode Fuzzy Hash: fb41b6aa0cae3f82317e0c6388428b0fd7fa67f7124ca0d72b61217752ca230b
Instruction Fuzzy Hash: 8B512D62A1CFC681EB108F29E8443FAA370FB997C8F516135EA8D42665DF7CD588C700

Function 00007FF8B8CD3EE0 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON312 ref: 00007FF8B8CD3F10
PyErr_SetString.PYTHON312 ref: 00007FF8B8CD3F3F
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD3F53
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD3F6C
PyDict_New.PYTHON312 ref: 00007FF8B8CD3F93
PyObject_GetAttr.PYTHON312 ref: 00007FF8B8CD3FB9
PyErr_ExceptionMatches.PYTHON312 ref: 00007FF8B8CD3FD1
PyErr_Clear.PYTHON312 ref: 00007FF8B8CD3FDF
PyDict_SetItem.PYTHON312 ref: 00007FF8B8CD3FF0
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD4007
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD4033

Strings

__mypyc_attrs__ is not a tuple, xrefs: 00007FF8B8CD3F35
__mypyc_attrs__, xrefs: 00007FF8B8CD3F01

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Err_$AttrDict_Object_String$ClearExceptionItemMatches
String ID: __mypyc_attrs__$__mypyc_attrs__ is not a tuple
API String ID: 2346549887-4201147154
Opcode ID: e66151341709f08fa87d516288480836e991296861bc7efaf3a726328e6597ee
Instruction ID: 0545ef2e2267772be7aa168547c2e47751aeed946b436574ac867d375394a75d
Opcode Fuzzy Hash: e66151341709f08fa87d516288480836e991296861bc7efaf3a726328e6597ee
Instruction Fuzzy Hash: DC414BB5A08A4682EBB4AF29E86C23963B0FB44FD5F444075CB1D46754EF3DF8468708

Function 00007FF8B93C2340 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FF8B93C2358
PyErr_FormatV.PYTHON312 ref: 00007FF8B93C237A
ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8B93C2393
ERR_lib_error_string.LIBCRYPTO-3 ref: 00007FF8B93C239B
ERR_func_error_string.LIBCRYPTO-3 ref: 00007FF8B93C23A6
ERR_reason_error_string.LIBCRYPTO-3 ref: 00007FF8B93C23B1
PyErr_Format.PYTHON312 ref: 00007FF8B93C23D9
PyErr_SetString.PYTHON312 ref: 00007FF8B93C50C5

Strings

[%s: %s] %s, xrefs: 00007FF8B93C50D9
no reason supplied, xrefs: 00007FF8B93C50BE
[%s] %s, xrefs: 00007FF8B93C23D2

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_$Format$R_clear_errorR_func_error_stringR_lib_error_stringR_peek_last_errorR_reason_error_stringString
String ID: [%s: %s] %s$[%s] %s$no reason supplied
API String ID: 748225740-1501659929
Opcode ID: 881203d62c976654d30891954a9730669c603754517961f2350c2cfc6bd88aed
Instruction ID: 00763290ed73ec7d433a50e50ad502330909c8d05b4eb133265bdd72596ed7cf
Opcode Fuzzy Hash: 881203d62c976654d30891954a9730669c603754517961f2350c2cfc6bd88aed
Instruction Fuzzy Hash: A42147A1A0CF8286EA109F19A84407B62B5BF4DBD1F506134EF4E07B28DF3CE54D8340

Function 00007FF8B8CD3590 Relevance: 22.8, APIs: 5, Strings: 8, Instructions: 19COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FF8B8CD28DB), ref: 00007FF8B8CD3599
fprintf.MSPDB140-MSVCRT ref: 00007FF8B8CD35A9

Part of subcall function 00007FF8B8CD1010: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B8CD1047

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FF8B8CD28DB), ref: 00007FF8B8CD35B3
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FF8B8CD28DB), ref: 00007FF8B8CD35BC
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8B8CD28DB), ref: 00007FF8B8CD35C2

Strings

__module__, xrefs: 00007FF8B8CD3617
None, xrefs: 00007FF8B8CD35E2
fatal: out of memory, xrefs: 00007FF8B8CD35A2
builtins, xrefs: 00007FF8B8CD366D
tuple[<%d items>], xrefs: 00007FF8B8CD36E4
%U%U%s, xrefs: 00007FF8B8CD375E
%U.%U, xrefs: 00007FF8B8CD3692
__qualname__, xrefs: 00007FF8B8CD3645

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: __acrt_iob_func$__stdio_common_vfprintfabortfflushfprintf
String ID: %U%U%s$%U.%U$None$__module__$__qualname__$builtins$fatal: out of memory$tuple[<%d items>]
API String ID: 3462009215-2533303582
Opcode ID: 3aae54b1b249fabbf7fa54b3ea6166519944189401f5320151bdc15871942efa
Instruction ID: 3de350ec0b5fe43eadc93d4218b157726f04c22ddb48e4a66c142777a8440549
Opcode Fuzzy Hash: 3aae54b1b249fabbf7fa54b3ea6166519944189401f5320151bdc15871942efa
Instruction Fuzzy Hash: 03D062D0D1550283E784A759F87D2746215AF447C3F40143DD62E06269DF1CBC468359

Function 00007FF8B8B31110 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 143threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312 ref: 00007FF8B8B31156
_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FF8B8B31197
PyThread_allocate_lock.PYTHON312 ref: 00007FF8B8B311FE
PyErr_Format.PYTHON312 ref: 00007FF8B8B31286
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B31299
PyErr_SetString.PYTHON312 ref: 00007FF8B8B31319
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B35E05

Strings

|iiOO:LZMACompressor, xrefs: 00007FF8B8B31169
Invalid container format: %d, xrefs: 00007FF8B8B3127C
Integrity checks are only supported by FORMAT_XZ, xrefs: 00007FF8B8B35DEC
Cannot specify both preset and filter chain, xrefs: 00007FF8B8B31308
Unable to allocate lock, xrefs: 00007FF8B8B35E12

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocErr_$Arg_FormatKeywords_ModuleParseSizeStateStringThread_allocate_lockTupleType_
String ID: Cannot specify both preset and filter chain$Integrity checks are only supported by FORMAT_XZ$Invalid container format: %d$Unable to allocate lock$|iiOO:LZMACompressor
API String ID: 1600877341-3984722346
Opcode ID: 1e688a17dabf5163ed9c27b377d890ab5408a498247c306a90725e182f9f5b69
Instruction ID: b0f8ad29e60765992155dd604ac1c1f026a5396e05c73210a0652c52d60c8280
Opcode Fuzzy Hash: 1e688a17dabf5163ed9c27b377d890ab5408a498247c306a90725e182f9f5b69
Instruction Fuzzy Hash: 87611732A48A1285EB508F39E8400BD37A9FB48BD8F504532EF0E53B58EF3CE5468748

Function 00007FF8B93C5C14 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FF8B93C5C33
PyErr_SetString.PYTHON312 ref: 00007FF8B93C5C58
PyErr_SetString.PYTHON312 ref: 00007FF8B93C5C7B

Strings

key is too long., xrefs: 00007FF8B93C5C4E
Missing required parameter 'digestmod'., xrefs: 00007FF8B93C5C71

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String$Module_State
String ID: Missing required parameter 'digestmod'.$key is too long.
API String ID: 450183790-3184708805
Opcode ID: aa89080a73bf17a460bf6f4e9cd30d3a08290901bf1590fe557ba88459ccc668
Instruction ID: 0d4b427454e77180eaa9576a267bb9ad47b2eff8ee3b6545ca6aed2a81a87156
Opcode Fuzzy Hash: aa89080a73bf17a460bf6f4e9cd30d3a08290901bf1590fe557ba88459ccc668
Instruction Fuzzy Hash: E441F821A1DF8281EA149F1AA85823AA3B1BF8CFD4F486431DF0E4B765DF3CE4498340

Function 00007FF8B8CE3850 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

PyModule_Create2.PYTHON312 ref: 00007FF8B8CE388A
PyCapsule_New.PYTHON312 ref: 00007FF8B8CE38B1
PyObject_SetAttrString.PYTHON312 ref: 00007FF8B8CE38D4
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE38EA
PyCapsule_New.PYTHON312 ref: 00007FF8B8CE3905
PyObject_SetAttrString.PYTHON312 ref: 00007FF8B8CE3924
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE393A

Strings

charset_normalizer.md__mypyc.init_charset_normalizer___md, xrefs: 00007FF8B8CE38F7
charset_normalizer.md__mypyc.exports, xrefs: 00007FF8B8CE38A3
exports, xrefs: 00007FF8B8CE38CA
init_charset_normalizer___md, xrefs: 00007FF8B8CE391A

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: AttrCapsule_DeallocObject_String$Create2Module_
String ID: charset_normalizer.md__mypyc.exports$charset_normalizer.md__mypyc.init_charset_normalizer___md$exports$init_charset_normalizer___md
API String ID: 2519120496-2411258805
Opcode ID: 6cb80ad11c98d76827863cb71e74507b593be2b67b62d800d4c12a6864baf513
Instruction ID: 1e9ec90a6c140fedcc4f428589cc239bb97fa97cc1c6b91f5db61be9ab47a17d
Opcode Fuzzy Hash: 6cb80ad11c98d76827863cb71e74507b593be2b67b62d800d4c12a6864baf513
Instruction Fuzzy Hash: 7031DBB5A19B0783EB958B2DE87C63423A0AF44BD6F455035CB2D067A8DF7CF8468718

Function 00007FF8B93C2560 Relevance: 19.6, APIs: 13, Instructions: 81threadCOMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C257C
EVP_MD_CTX_copy.LIBCRYPTO-3 ref: 00007FF8B93C25AA
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FF8B93C25CA
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF8B93C25D3
EVP_DigestFinal.LIBCRYPTO-3 ref: 00007FF8B93C25E6
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FF8B93C25FB
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF8B93C2607
PyThread_acquire_lock.PYTHON312 ref: 00007FF8B93C2635
PyThread_release_lock.PYTHON312 ref: 00007FF8B93C2648
PyErr_NoMemory.PYTHON312 ref: 00007FF8B93C512C
PyEval_SaveThread.PYTHON312 ref: 00007FF8B93C5139
PyThread_acquire_lock.PYTHON312 ref: 00007FF8B93C514B
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B93C5154

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$Bytes_D_get_sizeDigestErr_FinalFromMemoryRestoreSaveSizeStringThread_release_lockX_copyX_freeX_get0_mdX_new
String ID:
API String ID: 3454437874-0
Opcode ID: daa78a20e855eeb57fc627b40b2494b157a0973974f999fd34d7e88e9405f0b1
Instruction ID: 5e6d2239fb8c682ea40f1237314c35658763ff62dfef2b75722087ad8a86a2b1
Opcode Fuzzy Hash: daa78a20e855eeb57fc627b40b2494b157a0973974f999fd34d7e88e9405f0b1
Instruction Fuzzy Hash: F6311625A0DF8282EA249F2EA85817B63B1AF8CBD4F146431DE4F87764DE3CE4098750

Function 00007FF8B93C2660 Relevance: 19.6, APIs: 13, Instructions: 79threadCOMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C267C
EVP_MD_CTX_copy.LIBCRYPTO-3 ref: 00007FF8B93C26AA
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FF8B93C26CA
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF8B93C26D3
EVP_DigestFinal.LIBCRYPTO-3 ref: 00007FF8B93C26E6
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF8B93C26F7
_Py_strhex.PYTHON312 ref: 00007FF8B93C2704
PyThread_acquire_lock.PYTHON312 ref: 00007FF8B93C272F
PyThread_release_lock.PYTHON312 ref: 00007FF8B93C2742
PyErr_NoMemory.PYTHON312 ref: 00007FF8B93C5190
PyEval_SaveThread.PYTHON312 ref: 00007FF8B93C519D
PyThread_acquire_lock.PYTHON312 ref: 00007FF8B93C51AF
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B93C51B8

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$D_get_sizeDigestErr_FinalMemoryPy_strhexRestoreSaveThread_release_lockX_copyX_freeX_get0_mdX_new
String ID:
API String ID: 2571855718-0
Opcode ID: 063ef03bf0820d9e85f780c0ef791f972aa524f6cc3b90df4ec4125eeb5b1752
Instruction ID: b06a0b30cea5fc1817dad1a0e7552939c19e34f5e7676049981ba8f1d71cff28
Opcode Fuzzy Hash: 063ef03bf0820d9e85f780c0ef791f972aa524f6cc3b90df4ec4125eeb5b1752
Instruction Fuzzy Hash: 9731F525A0CF8282EA249F2EA89417B63B1AF8CBD5F146431DF4F46765DE3CE44D8750

Function 00007FF8B93C2800 Relevance: 19.6, APIs: 13, Instructions: 70COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON312 ref: 00007FF8B93C2818
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C282F
EVP_DigestFinalXOF.LIBCRYPTO-3 ref: 00007FF8B93C285D
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF8B93C286E
_Py_strhex.PYTHON312 ref: 00007FF8B93C287A
PyMem_Free.PYTHON312 ref: 00007FF8B93C2886
PyErr_NoMemory.PYTHON312 ref: 00007FF8B93C5272
PyMem_Free.PYTHON312 ref: 00007FF8B93C5282
PyErr_NoMemory.PYTHON312 ref: 00007FF8B93C5288

Part of subcall function 00007FF8B93C2A60: EVP_MD_CTX_copy.LIBCRYPTO-3(?,?,00000000,00007FF8B93C284C), ref: 00007FF8B93C2A85

PyMem_Free.PYTHON312 ref: 00007FF8B93C5298
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF8B93C52A1
PyMem_Free.PYTHON312 ref: 00007FF8B93C52C1
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF8B93C52CA

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Mem_$Free$X_free$Err_Memory$DigestFinalMallocPy_strhexX_copyX_new
String ID:
API String ID: 422439089-0
Opcode ID: e0da23306885a1de4733d5368fe5ed6115112598769a1cef94bd8da4b7b6e5ba
Instruction ID: 7cd9bedbcbbe431f25bbfd856b96394adee1efb40c95dac96c76e9aea7678122
Opcode Fuzzy Hash: e0da23306885a1de4733d5368fe5ed6115112598769a1cef94bd8da4b7b6e5ba
Instruction Fuzzy Hash: 5521A724B0DF8381EA54AF2BA95403B63B1AF9DFD1B486431EE4F46765DE2CE4498300

Function 00007FF8B8B30B5C Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

PyMapping_Check.PYTHON312(?,?,?,00000028,00007FF8B8B30AE3,?,00000000,00007FF8B8B30A18), ref: 00007FF8B8B30B81
PyMapping_GetItemString.PYTHON312(?,?,?,00000028,00007FF8B8B30AE3,?,00000000,00007FF8B8B30A18), ref: 00007FF8B8B30B9B
PyLong_AsUnsignedLongLong.PYTHON312(?,?,?,00000028,00007FF8B8B30AE3,?,00000000,00007FF8B8B30A18), ref: 00007FF8B8B30BB0
PyErr_Occurred.PYTHON312(?,?,?,00000028,00007FF8B8B30AE3,?,00000000,00007FF8B8B30A18), ref: 00007FF8B8B30BC7
PyErr_ExceptionMatches.PYTHON312(?,?,?,00000028,00007FF8B8B30AE3,?,00000000,00007FF8B8B30A18), ref: 00007FF8B8B30C40
PyErr_Format.PYTHON312(?,?,?,00000028,00007FF8B8B30AE3,?,00000000,00007FF8B8B30A18), ref: 00007FF8B8B30C89
PyErr_SetString.PYTHON312(?,?,?,00000028,00007FF8B8B30AE3,?,00000000,00007FF8B8B30A18), ref: 00007FF8B8B30CA2
_Py_Dealloc.PYTHON312(?,?,?,00000028,00007FF8B8B30AE3,?,00000000,00007FF8B8B30A18), ref: 00007FF8B8B35D3A

Strings

Filter specifier must be a dict or dict-like object, xrefs: 00007FF8B8B35D2B
Filter specifier must have an "id" entry, xrefs: 00007FF8B8B30C98
Invalid filter ID: %llu, xrefs: 00007FF8B8B30C7C

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Err_$LongMapping_String$CheckDeallocExceptionFormatItemLong_MatchesOccurredUnsigned
String ID: Filter specifier must be a dict or dict-like object$Filter specifier must have an "id" entry$Invalid filter ID: %llu
API String ID: 1881886752-3390802605
Opcode ID: 0c5f6f5e7484fbb015a79b71ea40a48de156ee4d8636223415d5697c2780f545
Instruction ID: 5d1294659d50533abd5034ad75df1c8483a9cdf7d4d6c3e56af8dd8f8ead65dc
Opcode Fuzzy Hash: 0c5f6f5e7484fbb015a79b71ea40a48de156ee4d8636223415d5697c2780f545
Instruction Fuzzy Hash: 8B41E771A88A03C5EE658F2DA89413973A4AF45BC5F448036CB8E46760EF7CE487C309

Function 00007FF8B8B30710 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8B8B30741
PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FF8B8B30756
PyErr_Occurred.PYTHON312 ref: 00007FF8B8B3075F
PyObject_GetBuffer.PYTHON312 ref: 00007FF8B8B30776
PyBuffer_IsContiguous.PYTHON312 ref: 00007FF8B8B30787
PyBuffer_Release.PYTHON312 ref: 00007FF8B8B307B5
_PyArg_CheckPositional.PYTHON312 ref: 00007FF8B8B35C03
_PyArg_BadArgument.PYTHON312 ref: 00007FF8B8B35C2F

Part of subcall function 00007FF8B8B307D4: PyModule_GetState.PYTHON312(?,?,?,?,?,00007FF8B8B307A5), ref: 00007FF8B8B307E6
Part of subcall function 00007FF8B8B307D4: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF8B8B307A5), ref: 00007FF8B8B30822

Strings

argument 2, xrefs: 00007FF8B8B35C21
contiguous buffer, xrefs: 00007FF8B8B35C1A
_decode_filter_properties, xrefs: 00007FF8B8B35BF9, 00007FF8B8B35C28

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Arg_Buffer_Long$ArgumentBufferCheckContiguousErr_Long_Module_Object_OccurredPositionalReleaseStateUnsignedfreememset
String ID: _decode_filter_properties$argument 2$contiguous buffer
API String ID: 3656606796-2431706548
Opcode ID: 6ac779201fb040bc529056ec0a6a5a048fdef9ca7122a7e56471178991ab58fb
Instruction ID: a326c6d54bb88eb439692db8b1a634afd9a79c6ad3096c46625d5ef52e08312c
Opcode Fuzzy Hash: 6ac779201fb040bc529056ec0a6a5a048fdef9ca7122a7e56471178991ab58fb
Instruction Fuzzy Hash: 4E317C21A48A46C2EA508F3AD8446A973A0FF98FC4F988131DB4D53764DF3CE94BC744

Function 00007FF8B8CD3880 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PyThreadState_Get.PYTHON312 ref: 00007FF8B8CD38A2
PyErr_Fetch.PYTHON312 ref: 00007FF8B8CD38BA
PyCode_NewEmpty.PYTHON312 ref: 00007FF8B8CD38CD
PyFrame_New.PYTHON312 ref: 00007FF8B8CD38E7
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD3902
_PyErr_ChainExceptions1.PYTHON312 ref: 00007FF8B8CD390D
PyErr_Restore.PYTHON312 ref: 00007FF8B8CD393A
PyTraceBack_Here.PYTHON312 ref: 00007FF8B8CD3943
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD3957
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD396B

Strings

charset_normalizer\md.py, xrefs: 00007FF8B8CD38C3

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocErr_$Back_ChainCode_EmptyExceptions1FetchFrame_HereRestoreState_ThreadTrace
String ID: charset_normalizer\md.py
API String ID: 1599779757-1392889821
Opcode ID: 929c761034df64e23572057a73fe2c5fab85c31af172243b9a7b6395f97a8051
Instruction ID: 22f9ff6f77763b2c73f5004bdf9be0b024bad4dcd9a74fe411b18d26c4f04335
Opcode Fuzzy Hash: 929c761034df64e23572057a73fe2c5fab85c31af172243b9a7b6395f97a8051
Instruction Fuzzy Hash: A02121B6A08B4282DBA09F25E96816D77B0FB49BD5F444031DB5D07B68DF3CE946CB04

Function 00007FF8B8B286B8 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 60COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8B28707
PyErr_NoMemory.PYTHON312 ref: 00007FF8B8B34E18

Strings

Insufficient buffer space, xrefs: 00007FF8B8B28754
Internal error, xrefs: 00007FF8B8B2872C
Unrecognized error from liblzma: %d, xrefs: 00007FF8B8B34E37
Corrupt input data, xrefs: 00007FF8B8B2874B
Invalid or unsupported options, xrefs: 00007FF8B8B28742
Memory usage limit exceeded, xrefs: 00007FF8B8B28735
Input format not supported by decoder, xrefs: 00007FF8B8B286FC
Unsupported integrity check, xrefs: 00007FF8B8B34E24

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Err_$MemoryString
String ID: Corrupt input data$Input format not supported by decoder$Insufficient buffer space$Internal error$Invalid or unsupported options$Memory usage limit exceeded$Unrecognized error from liblzma: %d$Unsupported integrity check
API String ID: 60457842-2177155514
Opcode ID: e667bd3184b1031ca586e5cabd8905ebea692642c7ea9d8a448339030e972199
Instruction ID: 7c3897249cdb48efff0704a76239dc6b384240683140f19d3596f368e5a08d9c
Opcode Fuzzy Hash: e667bd3184b1031ca586e5cabd8905ebea692642c7ea9d8a448339030e972199
Instruction Fuzzy Hash: 27210725EAC61391FAA98B3C985807C1EA1AF557C1FE46031C71E429A49F6EF947C30D

Function 00007FF8B8CD6E20 Relevance: 18.1, APIs: 12, Instructions: 104threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON312 ref: 00007FF8B8CD6E2D
_PyTrash_cond.PYTHON312 ref: 00007FF8B8CD6E3F
_PyThreadState_UncheckedGet.PYTHON312 ref: 00007FF8B8CD6E49
_PyTrash_begin.PYTHON312 ref: 00007FF8B8CD6E58
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD6E89
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD6EB2
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD6EDB
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD6F04
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD6F2D
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD6F4F
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD6F78
_PyTrash_end.PYTHON312 ref: 00007FF8B8CD6F93

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_beginTrash_condTrash_endUnchecked
String ID:
API String ID: 2819143443-0
Opcode ID: 34ec5bebfffadac6be9bf9876dce8c975bd5e57f5d382802bd6aac2d38012139
Instruction ID: 27133f22644721d459bc3e2f2f5c7c138d70f14c32bf91de1253955ee3eaddca
Opcode Fuzzy Hash: 34ec5bebfffadac6be9bf9876dce8c975bd5e57f5d382802bd6aac2d38012139
Instruction Fuzzy Hash: ED51ECB6908A4281EBB59F7CD46C77832A0AB44BB9F144334CB79426D4CF7DE886C784

Function 00007FF8B90610D0 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B90610F8
__scrt_initialize_crt.LIBCMT ref: 00007FF8B906113D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B906114A
_RTC_Initialize.LIBCMT ref: 00007FF8B9061178
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B906119E
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B90611C9

Memory Dump Source

Source File: 00000003.00000002.2174014272.00007FF8B9061000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9060000, based on PE: true

Associated: 00000003.00000002.2173996919.00007FF8B9060000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000003.00000002.2174033510.00007FF8B9062000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000003.00000002.2174052648.00007FF8B9064000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b9060000_LKEAHetlG6.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 5d72e879cf7946976a5814a50ab2a295b69da044195d469edd6d5210a35643fb
Instruction ID: 2becc0ebc061150f4a4c5b9358cf37384dc7e2ff08470388fb4b75f0668f27aa
Opcode Fuzzy Hash: 5d72e879cf7946976a5814a50ab2a295b69da044195d469edd6d5210a35643fb
Instruction Fuzzy Hash: F7816921E0C2C386FE90EF6E94412B976A4AF95BC4F04C139EB4D87696DF7CE9479600

Function 00007FF8B8CE39C0 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B8CE39E8
__scrt_initialize_crt.LIBCMT ref: 00007FF8B8CE3A2D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B8CE3A3A
_RTC_Initialize.LIBCMT ref: 00007FF8B8CE3A68
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B8CE3A8E
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B8CE3AB9

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 96e2149260328018f2ee9c3f905d278b01a8d9e20d367414482ed3a890371b1c
Instruction ID: 02d0ac0c05dcd9a306ba6bcf63332b86e9f32430e394d9dc57aeff5188e37016
Opcode Fuzzy Hash: 96e2149260328018f2ee9c3f905d278b01a8d9e20d367414482ed3a890371b1c
Instruction Fuzzy Hash: 72819FA1E0C64347F7D0AB7EA46927922A0AF857C2F448135EB2D47796DF2DF8478608

Function 00007FF8B8B27FEC Relevance: 16.7, APIs: 11, Instructions: 154COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON312 ref: 00007FF8B8B280AD
memcpy.VCRUNTIME140 ref: 00007FF8B8B280D5
memcpy.VCRUNTIME140 ref: 00007FF8B8B2811F
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FF8B8B28152
PyMem_Realloc.PYTHON312 ref: 00007FF8B8B28196
memmove.VCRUNTIME140 ref: 00007FF8B8B281C4
PyErr_SetNone.PYTHON312 ref: 00007FF8B8B34CC0
PyMem_Free.PYTHON312 ref: 00007FF8B8B34CE5
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B34D19

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Mem_$memcpy$Bytes_DeallocErr_FreeFromMallocNoneReallocSizeStringmemmove
String ID:
API String ID: 1220578264-0
Opcode ID: 85adeaa55f33651ef0f232b94068ae9b2308325af99af7830eee87ddd8bfa38a
Instruction ID: f95a55a95d60bad279d1298cbef68ee182b9ae9070195b6182713210fa535bae
Opcode Fuzzy Hash: 85adeaa55f33651ef0f232b94068ae9b2308325af99af7830eee87ddd8bfa38a
Instruction Fuzzy Hash: 3A516D22A19B4281EB64CF39A94023E67A5FB58FD5F584031CF4D177A8DF3CE4928309

Function 00007FF8B8CDDBF0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON312(?,?,?,?,?,00007FF8B8CD79AE), ref: 00007FF8B8CDDC83
PyLong_FromSsize_t.PYTHON312(?,?,?,?,?,00007FF8B8CD79AE), ref: 00007FF8B8CDDCD2
PyLong_FromSsize_t.PYTHON312(?,?,?,?,?,00007FF8B8CD79AE), ref: 00007FF8B8CDDCFE
PyObject_RichCompareBool.PYTHON312(?,?,?,?,?,00007FF8B8CD79AE), ref: 00007FF8B8CDDD15
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8B8CD79AE), ref: 00007FF8B8CDDD2B
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8B8CD79AE), ref: 00007FF8B8CDDD3F

Strings

charset_normalizer.md.CjkInvalidStopPlugin, xrefs: 00007FF8B8CDDDE8
ratio, xrefs: 00007FF8B8CDDC99
__init__, xrefs: 00007FF8B8CDDD89, 00007FF8B8CDDDFB

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocFromLong_Ssize_t$BoolCompareErr_Object_OccurredRich
String ID: __init__$charset_normalizer.md.CjkInvalidStopPlugin$ratio
API String ID: 871640449-4126926341
Opcode ID: 50dfb51dc545f733170bcd5f131fd8dec372b9381f754ea30373e4415d5ce4ea
Instruction ID: 7305cfa290c300beb646a209bd73644fea797f5b7007d46e2f604c6471dd4b5e
Opcode Fuzzy Hash: 50dfb51dc545f733170bcd5f131fd8dec372b9381f754ea30373e4415d5ce4ea
Instruction Fuzzy Hash: B05173A1E0864643EBF46B2DA82827963A0AF44BD1F484131DB2D077A5DF7CF4438B58

Function 00007FF8B8CD4820 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD4852
PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD487E
PySlice_New.PYTHON312 ref: 00007FF8B8CD48A8
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD48BF
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD48D3
PyObject_GetItem.PYTHON312 ref: 00007FF8B8CD48E4
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD48FB
PyErr_SetString.PYTHON312 ref: 00007FF8B8CD494E

Strings

interpreted classes cannot inherit from compiled, xrefs: 00007FF8B8CD4944

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$Err_ItemObject_Slice_String
String ID: interpreted classes cannot inherit from compiled
API String ID: 575668516-2110327174
Opcode ID: 4e2baef39ba8fe060f07d6d6f0bced05c2d01185e87a098f7d4dafbc9954950d
Instruction ID: bead73423021b58a63180ff45182afe3936e033e5b428e28410d8a01ca8953ac
Opcode Fuzzy Hash: 4e2baef39ba8fe060f07d6d6f0bced05c2d01185e87a098f7d4dafbc9954950d
Instruction Fuzzy Hash: 4D4158B5E09A4286EBF45F2A996C2782390AF45BE1F484130DB6D47BD4DF2DF4538B08

Function 00007FF8B8CDA110 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B8CD2920: PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD2961
Part of subcall function 00007FF8B8CD2920: PyNumber_Add.PYTHON312 ref: 00007FF8B8CD29B7
Part of subcall function 00007FF8B8CD2920: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD29D7
Part of subcall function 00007FF8B8CD2920: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD29EB

PyDict_GetItemWithError.PYTHON312 ref: 00007FF8B8CDA16B
PyErr_Occurred.PYTHON312 ref: 00007FF8B8CDA179
PyErr_SetObject.PYTHON312 ref: 00007FF8B8CDA191
PyObject_Vectorcall.PYTHON312 ref: 00007FF8B8CDA1C6
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDA1DD
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDA220

Strings

feed, xrefs: 00007FF8B8CDA232
bool, xrefs: 00007FF8B8CDA1F8

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Err_$Dict_ErrorFromItemLong_Number_ObjectObject_OccurredSsize_tVectorcallWith
String ID: bool$feed
API String ID: 2189706420-2849697477
Opcode ID: 958a22a6337853555e897f1e5a14fcd0471710981ec55253fe3441e9c772aafb
Instruction ID: 423a95cca1811a45bd582fda287364e7242a84da8e46bd674970a4bb17de2d38
Opcode Fuzzy Hash: 958a22a6337853555e897f1e5a14fcd0471710981ec55253fe3441e9c772aafb
Instruction Fuzzy Hash: B94145B5A09A02C2EBB1AB1DE56827973A1FF44BC1F445035DB5D07B65DF2DF4428B08

Function 00007FF8B8CDA720 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON312 ref: 00007FF8B8CDA758
PyErr_Occurred.PYTHON312 ref: 00007FF8B8CDA766
PyErr_SetObject.PYTHON312 ref: 00007FF8B8CDA77E
PyObject_GetItem.PYTHON312 ref: 00007FF8B8CDA791
PyObject_Vectorcall.PYTHON312 ref: 00007FF8B8CDA7B3
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDA7CA
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDA80F

Strings

feed, xrefs: 00007FF8B8CDA822
bool, xrefs: 00007FF8B8CDA7E5

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocErr_ItemObject_$Dict_ErrorObjectOccurredVectorcallWith
String ID: bool$feed
API String ID: 2902451266-2849697477
Opcode ID: f4f92837b73cd07083ecf196f641edd5c5d76e013ce287cc97f39c4dfbe217e1
Instruction ID: ed6ce215dabb90821e2812cbf3dfb492f24e950efcb91a13fde6250995ab5e9d
Opcode Fuzzy Hash: f4f92837b73cd07083ecf196f641edd5c5d76e013ce287cc97f39c4dfbe217e1
Instruction Fuzzy Hash: 484124B5A09A4282EBB5AF19E86827963A1FF44BC1F448031DF5D47B65DF2CF4438B08

Function 00007FF8B8CDF2F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B8CD2920: PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD2961
Part of subcall function 00007FF8B8CD2920: PyNumber_Add.PYTHON312 ref: 00007FF8B8CD29B7
Part of subcall function 00007FF8B8CD2920: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD29D7
Part of subcall function 00007FF8B8CD2920: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD29EB

PyDict_GetItemWithError.PYTHON312 ref: 00007FF8B8CDF34B
PyErr_Occurred.PYTHON312 ref: 00007FF8B8CDF359
PyErr_SetObject.PYTHON312 ref: 00007FF8B8CDF371
PyObject_Vectorcall.PYTHON312 ref: 00007FF8B8CDF3A6
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDF3BD
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDF400

Strings

feed, xrefs: 00007FF8B8CDF412
bool, xrefs: 00007FF8B8CDF3D8

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Err_$Dict_ErrorFromItemLong_Number_ObjectObject_OccurredSsize_tVectorcallWith
String ID: bool$feed
API String ID: 2189706420-2849697477
Opcode ID: 8e0caade2916fc91190bf6248451af5af673b86bd580171c2b13f121ea62ae45
Instruction ID: cef65e277aa818b9a49accc4c818c080c906f42e624d6a585a44f6a192b50c7d
Opcode Fuzzy Hash: 8e0caade2916fc91190bf6248451af5af673b86bd580171c2b13f121ea62ae45
Instruction Fuzzy Hash: 2A4150B2A19A0282EBB0AF1DE56827963A1FF48BC1F444031DB5D47B59DF2CF4428B08

Function 00007FF8B8CDF0E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON312 ref: 00007FF8B8CDF110
PyErr_Occurred.PYTHON312 ref: 00007FF8B8CDF11E
PyErr_SetObject.PYTHON312 ref: 00007FF8B8CDF136
PyObject_GetItem.PYTHON312 ref: 00007FF8B8CDF149
PyObject_Vectorcall.PYTHON312 ref: 00007FF8B8CDF16B
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDF182
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDF1C7

Strings

eligible, xrefs: 00007FF8B8CDF1DA
bool, xrefs: 00007FF8B8CDF19D

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocErr_ItemObject_$Dict_ErrorObjectOccurredVectorcallWith
String ID: bool$eligible
API String ID: 2902451266-3320767611
Opcode ID: eacaf991cd320d3b28d9c0a86148e8b297e2767c2de5e507dac64fabba49b49f
Instruction ID: c296ff28af5a3f1a9173c95238fcb3fcb81b69ef768fc0be43490341a7ade060
Opcode Fuzzy Hash: eacaf991cd320d3b28d9c0a86148e8b297e2767c2de5e507dac64fabba49b49f
Instruction Fuzzy Hash: F23130B1A19A4282EBF19B1DE96817963A1FF44BC5F486031DB5D07B58DF2CF842CB08

Function 00007FF8B8B33550 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B8B33578
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B8B335CA
_RTC_Initialize.LIBCMT ref: 00007FF8B8B335F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B8B3361E
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B8B33649

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 425fd5ac1271bb133272e3ab21a2143b35eb579dd60372998353d793c77f0ddb
Instruction ID: b6f1fd7bac00ee4345df8b6405b0825a5b1c4f2ba110b253fe731db51a379282
Opcode Fuzzy Hash: 425fd5ac1271bb133272e3ab21a2143b35eb579dd60372998353d793c77f0ddb
Instruction Fuzzy Hash: 0F818C22E8C64396FA54AB7EB4512BA6690AF4DBC0F444035EB0D47792EF3CF9478708

Function 00007FF8B93C3D10 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B93C3D38
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B93C3D8A
_RTC_Initialize.LIBCMT ref: 00007FF8B93C3DB8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B93C3DDE
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B93C3E09

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: ad632e60de9384afdfd7f42ceb838f79c6fef9ceb322364d021ec22254250735
Instruction ID: 4b861373b17be906d0fe61adf92c7c8538651b1f5b6206334cb06cbb4ba6c4c7
Opcode Fuzzy Hash: ad632e60de9384afdfd7f42ceb838f79c6fef9ceb322364d021ec22254250735
Instruction Fuzzy Hash: DB816C61E0CBC346FA90AF6E94452BB66B0AF8D7C0F546435EB4D47796DE2DE80D8700

Function 00007FF8B8CD80F0 Relevance: 15.1, APIs: 10, Instructions: 82threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON312 ref: 00007FF8B8CD80FD
_PyTrash_cond.PYTHON312 ref: 00007FF8B8CD810F
_PyThreadState_UncheckedGet.PYTHON312 ref: 00007FF8B8CD8119
_PyTrash_begin.PYTHON312 ref: 00007FF8B8CD8128
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD8159
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD8182
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD81AB
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD81D4
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD81F6
_PyTrash_end.PYTHON312 ref: 00007FF8B8CD8211

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_beginTrash_condTrash_endUnchecked
String ID:
API String ID: 2819143443-0
Opcode ID: 23d97488961b93e407653e4d04d1075f3d4a6115df0bee2f52c695c0df5d3962
Instruction ID: 1d8895ce30a9919ac7973ee571d5a0e7bf73ec49e224db74324e7c233ce72ed5
Opcode Fuzzy Hash: 23d97488961b93e407653e4d04d1075f3d4a6115df0bee2f52c695c0df5d3962
Instruction Fuzzy Hash: 0241FEB691860291EBB55F2D986C37832A0EF45FB9F146730CB29422D4CF7DE48A870C

Function 00007FF8B93C29D0 Relevance: 15.1, APIs: 10, Instructions: 74COMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON312 ref: 00007FF8B93C29E7
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C29FA
EVP_DigestFinalXOF.LIBCRYPTO-3 ref: 00007FF8B93C2A29
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF8B93C2A3A
_Py_Dealloc.PYTHON312 ref: 00007FF8B93C53C0
PyErr_NoMemory.PYTHON312 ref: 00007FF8B93C53C6

Part of subcall function 00007FF8B93C2A60: EVP_MD_CTX_copy.LIBCRYPTO-3(?,?,00000000,00007FF8B93C284C), ref: 00007FF8B93C2A85

_Py_Dealloc.PYTHON312 ref: 00007FF8B93C53E1
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF8B93C53EA
_Py_Dealloc.PYTHON312 ref: 00007FF8B93C5415
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF8B93C541E

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocX_free$Bytes_DigestErr_FinalFromMemorySizeStringX_copyX_new
String ID:
API String ID: 3259613670-0
Opcode ID: bcb404511692de2844bac06c54ac9f445eb19a44b1ea7384dfe0b50dcb24a294
Instruction ID: d75d2a52d849dc49b51f4a74166e323a4bdc99aa863cab239ade90a574240f6e
Opcode Fuzzy Hash: bcb404511692de2844bac06c54ac9f445eb19a44b1ea7384dfe0b50dcb24a294
Instruction Fuzzy Hash: DB31E825A0CF8281EB249F2AA99427B22B0AF8DBD1F047431DF4F46661DF3CE5598700

Function 00007FF8B8CDA440 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 149COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON312(?,?,?,?,?,00007FF8B8CD59BE), ref: 00007FF8B8CDA4DE
PyLong_FromSsize_t.PYTHON312(?,?,?,?,?,00007FF8B8CD59BE), ref: 00007FF8B8CDA53B
PyObject_RichCompareBool.PYTHON312(?,?,?,?,?,00007FF8B8CD59BE), ref: 00007FF8B8CDA552
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8B8CD59BE), ref: 00007FF8B8CDA568
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8B8CD59BE), ref: 00007FF8B8CDA57C

Strings

charset_normalizer.md.UnprintablePlugin, xrefs: 00007FF8B8CDA628
ratio, xrefs: 00007FF8B8CDA4F4
__init__, xrefs: 00007FF8B8CDA5C9, 00007FF8B8CDA63B

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$BoolCompareErr_FromLong_Object_OccurredRichSsize_t
String ID: __init__$charset_normalizer.md.UnprintablePlugin$ratio
API String ID: 2538524772-1538754472
Opcode ID: bd24d104d4e5ddc98eea7bfccf0ae522fc41dc3e0d7e104114ce5afde9d774f5
Instruction ID: 7bbd34f56bb2e46b26eefec2c05fcf9ddf351666b4c1fbb545c7159a2a360925
Opcode Fuzzy Hash: bd24d104d4e5ddc98eea7bfccf0ae522fc41dc3e0d7e104114ce5afde9d774f5
Instruction Fuzzy Hash: 9F5165A1D08A0682E7F5AB2D982817963A1EF44BD1F484531EF5D177A5EF3CF4438B48

Function 00007FF8B8CE2220 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PyFloat_AsDouble.PYTHON312 ref: 00007FF8B8CE22AF
PyErr_Occurred.PYTHON312 ref: 00007FF8B8CE22C4
PyErr_Occurred.PYTHON312 ref: 00007FF8B8CE2330
PyFloat_FromDouble.PYTHON312 ref: 00007FF8B8CE233E

Strings

str, xrefs: 00007FF8B8CE235A
bool, xrefs: 00007FF8B8CE22FF
mess_ratio, xrefs: 00007FF8B8CE236D
float, xrefs: 00007FF8B8CE22D4

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DoubleErr_Float_Occurred$From
String ID: bool$float$mess_ratio$str
API String ID: 627764739-3758540285
Opcode ID: 8a02f97511670b38e9bcd773b23a0c6d973fa38f5433283c19ee847a82f0f0a0
Instruction ID: 9a530e02aa4290b8cfc3e3acc3d6af094ed90c1ad99a57f3a2ee41d8883e7501
Opcode Fuzzy Hash: 8a02f97511670b38e9bcd773b23a0c6d973fa38f5433283c19ee847a82f0f0a0
Instruction Fuzzy Hash: 9B4195A1A0CA4282EB918F1DE4682BAA364FF997C2F144131EB6D03664DF3CF547C708

Function 00007FF8B93C2280 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312(?,?,00000000,00007FF8B93C2131), ref: 00007FF8B93C229A
_Py_hashtable_get.PYTHON312(?,?,00000000,00007FF8B93C2131), ref: 00007FF8B93C22AA
EVP_MD_up_ref.LIBCRYPTO-3(?,?,00000000,00007FF8B93C2131), ref: 00007FF8B93C22CD
EVP_MD_fetch.LIBCRYPTO-3(?,?,00000000,00007FF8B93C2131), ref: 00007FF8B93C22F4
EVP_MD_fetch.LIBCRYPTO-3(?,?,00000000,00007FF8B93C2131), ref: 00007FF8B93C2319

Strings

-fips, xrefs: 00007FF8B93C507E, 00007FF8B93C50B1
unsupported hash type %s, xrefs: 00007FF8B93C232B

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: D_fetch$D_up_refModule_Py_hashtable_getState
String ID: -fips$unsupported hash type %s
API String ID: 1568902971-2522765902
Opcode ID: 9bf40ab20de0d28e8d0a6f88b8d05df59be241efebc79f61e9cf85efd65cbced
Instruction ID: bcd7e51e2f04fcba35471759a4ded7fecd014ce207a5419ee911ce0e66760073
Opcode Fuzzy Hash: 9bf40ab20de0d28e8d0a6f88b8d05df59be241efebc79f61e9cf85efd65cbced
Instruction Fuzzy Hash: 3231F821A09F9382EAA54F2EA48417B66B0AF4DBD0F582435DF4E477A5DE2DE4498300

Function 00007FF8B8CE3678 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE367F
PyDict_SetItem.PYTHON312 ref: 00007FF8B8CE36A3
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE36C1
PyObject_Vectorcall.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE3731
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE3748
PyObject_Vectorcall.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE376D
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE3784

Strings

<module>, xrefs: 00007FF8B8CE3796

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Object_Vectorcall$Dict_Item
String ID: <module>
API String ID: 1355803777-217463007
Opcode ID: f44407c62ba38c985b018eb4be88fb5605f156d51110e078f0643a87e94a1170
Instruction ID: 4a1d3594e9d7a07483f3fea2190adedc0b4a8bee5ee6a176a0d4a08a86c164a2
Opcode Fuzzy Hash: f44407c62ba38c985b018eb4be88fb5605f156d51110e078f0643a87e94a1170
Instruction Fuzzy Hash: A83130E5A09A5382EBE05F2DE9A827563A0AF44BD6F444035CB2D07B59DF2DF446C708

Function 00007FF8B93C5F48 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 71threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B93C5FA8

Part of subcall function 00007FF8B93C6404: PyErr_Occurred.PYTHON312(?,?,?,00007FF8B93C5C98), ref: 00007FF8B93C6441
Part of subcall function 00007FF8B93C6404: PyModule_GetState.PYTHON312(?,?,?,00007FF8B93C5C98), ref: 00007FF8B93C644F
Part of subcall function 00007FF8B93C6404: PyErr_Format.PYTHON312(?,?,?,00007FF8B93C5C98), ref: 00007FF8B93C6463

PyEval_SaveThread.PYTHON312 ref: 00007FF8B93C5FE8
HMAC.LIBCRYPTO-3 ref: 00007FF8B93C601B
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B93C6027
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B93C6030
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FF8B93C6061

Part of subcall function 00007FF8B93C2340: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FF8B93C2358
Part of subcall function 00007FF8B93C2340: PyErr_FormatV.PYTHON312 ref: 00007FF8B93C237A

Strings

key is too long., xrefs: 00007FF8B93C5F97
msg is too long., xrefs: 00007FF8B93C5FBF

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_$Eval_FormatStringThread$Bytes_D_freeFromModule_OccurredR_peek_last_errorRestoreSaveSizeState
String ID: key is too long.$msg is too long.
API String ID: 915225383-4266787399
Opcode ID: 25362360c8b159205e36b4927e12f2d81151e450ce63696c659d494535d66d16
Instruction ID: aa82af6107771c94fa468854fc09ba3db5d0fc1f6062789cc8adf17b8da90729
Opcode Fuzzy Hash: 25362360c8b159205e36b4927e12f2d81151e450ce63696c659d494535d66d16
Instruction Fuzzy Hash: C8311B22A0CFD286EA20DF19E45436AA370FB8DBC4F146235DE4D42B69DF3CE1498700

Function 00007FF8B93C1815 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF8B93C1629
PyModule_GetState.PYTHON312 ref: 00007FF8B93C163A
_PyObject_New.PYTHON312 ref: 00007FF8B93C1643
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C1655
EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF8B93C1671
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B93C16B9

Part of subcall function 00007FF8B93C2340: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FF8B93C2358
Part of subcall function 00007FF8B93C2340: PyErr_FormatV.PYTHON312 ref: 00007FF8B93C237A

EVP_MD_fetch.LIBCRYPTO-3 ref: 00007FF8B93C181A

Strings

unsupported hash type %s, xrefs: 00007FF8B93C4E30

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: D_fetchD_freeD_get_flagsDigestErr_FormatInit_exModule_Object_R_peek_last_errorStateX_new
String ID: unsupported hash type %s
API String ID: 80754726-1604032313
Opcode ID: 243a4bed16886a324ecc7baaf6410dc429dc60b114cd24e6e948bc697a62bd03
Instruction ID: ddce091c708598a8cd6c5eed8d24c544578be7d1f7cade56dcb2f3297c59a01d
Opcode Fuzzy Hash: 243a4bed16886a324ecc7baaf6410dc429dc60b114cd24e6e948bc697a62bd03
Instruction Fuzzy Hash: 5A113A65B09F8282EEA59F6AA41427B62B1AF4CFD1F086434DF4E07760EF3DE4599300

Function 00007FF8B8B284D0 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8B8B284FA
PyObject_GetBuffer.PYTHON312 ref: 00007FF8B8B2850A
PyBuffer_IsContiguous.PYTHON312 ref: 00007FF8B8B2851B
PyBuffer_Release.PYTHON312 ref: 00007FF8B8B28546
_PyArg_BadArgument.PYTHON312 ref: 00007FF8B8B34D8A

Part of subcall function 00007FF8B8B29010: PyThread_acquire_lock.PYTHON312(?,?,?,00007FF8B8B28536), ref: 00007FF8B8B29036
Part of subcall function 00007FF8B8B29010: PyThread_release_lock.PYTHON312(?,?,?,00007FF8B8B28536), ref: 00007FF8B8B29068

Strings

argument, xrefs: 00007FF8B8B34D7C
contiguous buffer, xrefs: 00007FF8B8B34D75
compress, xrefs: 00007FF8B8B34D83

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Buffer_$Arg_ArgumentBufferContiguousObject_ReleaseThread_acquire_lockThread_release_lockmemset
String ID: argument$compress$contiguous buffer
API String ID: 1731275941-2310704374
Opcode ID: e49fcee8418d40925be70ffaeb55ce411285ea8029e7bf477f1f0c24e54d7857
Instruction ID: d190aa7c2d48bd1864d63031c18ed8cd07a38fbef2a0ec48336c30588a5914a5
Opcode Fuzzy Hash: e49fcee8418d40925be70ffaeb55ce411285ea8029e7bf477f1f0c24e54d7857
Instruction Fuzzy Hash: DC118262B18A4691EB20DF39E8442BD6360FB88BC4F988131DB4D53664DF3CE947C744

Function 00007FF8B8CD41E0 Relevance: 13.8, APIs: 9, Instructions: 308COMMON

Download Yara Rule

APIs

PyUnicode_FromStringAndSize.PYTHON312 ref: 00007FF8B8CD42E9
PyUnicode_InternInPlace.PYTHON312 ref: 00007FF8B8CD4302
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FF8B8CD43B9
PyLong_FromString.PYTHON312 ref: 00007FF8B8CD443E
PyFloat_FromDouble.PYTHON312 ref: 00007FF8B8CD44B8
PyComplex_FromDoubles.PYTHON312 ref: 00007FF8B8CD4520
PyTuple_New.PYTHON312 ref: 00007FF8B8CD455F
PyFrozenSet_New.PYTHON312 ref: 00007FF8B8CD45CB
PySet_Add.PYTHON312 ref: 00007FF8B8CD45F7

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: From$String$Set_SizeUnicode_$Bytes_Complex_DoubleDoublesFloat_FrozenInternLong_PlaceTuple_
String ID:
API String ID: 1377717875-0
Opcode ID: 1bc6b832a9b101eb94450793bee28bff6ca2690a3c262528acd6d01682900b35
Instruction ID: 3d5c0f3135490e8082ab6d2fc3befb21b7082ac51fae18618f62ea86b9709c9f
Opcode Fuzzy Hash: 1bc6b832a9b101eb94450793bee28bff6ca2690a3c262528acd6d01682900b35
Instruction Fuzzy Hash: 39C105A1A09B4282EBB16F1CA87827977A1EF057D5F484235DB6D17794DF2CE053CB08

Function 00007FF8B8CD4D40 Relevance: 13.6, APIs: 9, Instructions: 71threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON312 ref: 00007FF8B8CD4D4D
_PyTrash_cond.PYTHON312 ref: 00007FF8B8CD4D5F
_PyThreadState_UncheckedGet.PYTHON312 ref: 00007FF8B8CD4D69
_PyTrash_begin.PYTHON312 ref: 00007FF8B8CD4D78
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD4DA9
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD4DD2
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD4DFB
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD4E1D
_PyTrash_end.PYTHON312 ref: 00007FF8B8CD4E38

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_beginTrash_condTrash_endUnchecked
String ID:
API String ID: 2819143443-0
Opcode ID: fff406a76837bdfc3caa631c0de594268f2a13e9ca8c66fb56096f08c5388120
Instruction ID: 0283a53e389ef70006a325c33dc0b8d54b97b9e7ef3f3c01bb5f23a596057f20
Opcode Fuzzy Hash: fff406a76837bdfc3caa631c0de594268f2a13e9ca8c66fb56096f08c5388120
Instruction Fuzzy Hash: BE31EFB690870281E7B55F39D46C33862A0AF44FBAF154274CB7D466D8CF7DE4868744

Function 00007FF8B8CD3220 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

PyUnicode_New.PYTHON312 ref: 00007FF8B8CD3311
PyErr_SetString.PYTHON312 ref: 00007FF8B8CD3358
PyErr_Format.PYTHON312 ref: 00007FF8B8CD3387
memcpy.VCRUNTIME140 ref: 00007FF8B8CD340E
_PyUnicode_FastCopyCharacters.PYTHON312 ref: 00007FF8B8CD346F

Strings

join() result is too long for a Python string, xrefs: 00007FF8B8CD334E
sequence item %zd: expected str instance, %.80s found, xrefs: 00007FF8B8CD3376

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_Unicode_$CharactersCopyFastFormatStringmemcpy
String ID: join() result is too long for a Python string$sequence item %zd: expected str instance, %.80s found
API String ID: 3966466113-1579438684
Opcode ID: bd94065e028ba6fa2eb67220a7b20d7e8b3b3746a6e474679368a889752c658a
Instruction ID: 8a5f4950e604696679b278cbb4de5e4d1cbf18a60d890f881592b2383f97e883
Opcode Fuzzy Hash: bd94065e028ba6fa2eb67220a7b20d7e8b3b3746a6e474679368a889752c658a
Instruction Fuzzy Hash: 9E61C2E3B0564682EBB09B1DD8587B96690BB85BE1F054275CE2D833D4EF3CE8478704

Function 00007FF8B8CDC130 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312(?,?,?,?,?,00007FF8B8CD6A6E), ref: 00007FF8B8CDC167
PyObject_RichCompareBool.PYTHON312(?,?,?,?,?,00007FF8B8CD6A6E), ref: 00007FF8B8CDC1AE
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8B8CD6A6E), ref: 00007FF8B8CDC1C4
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8B8CD6A6E), ref: 00007FF8B8CDC1D8
PyErr_Occurred.PYTHON312(?,?,?,?,?,00007FF8B8CD6A6E), ref: 00007FF8B8CDC273

Strings

ratio, xrefs: 00007FF8B8CDC285

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$BoolCompareErr_FromLong_Object_OccurredRichSsize_t
String ID: ratio
API String ID: 2538524772-4234197119
Opcode ID: 3df6ddb79008031f2fa932144166eaa2e045ed27a22e43e2cec9a9a03f3e1f1f
Instruction ID: f324a4ed9e173b8aa3702722e672d77d76cf4d06324036ee0f1c047bd8bb7d8b
Opcode Fuzzy Hash: 3df6ddb79008031f2fa932144166eaa2e045ed27a22e43e2cec9a9a03f3e1f1f
Instruction Fuzzy Hash: 135193B190861382E7B46B6D986827863A0AF45BD0F185130DF5D077A6DF3DF8538B08

Function 00007FF8B8B3246C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FF8B8B28041), ref: 00007FF8B8B324B8
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?,?,?,00007FF8B8B28041), ref: 00007FF8B8B324FC
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FF8B8B28041), ref: 00007FF8B8B32518
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FF8B8B28041), ref: 00007FF8B8B32567

Strings

Unable to allocate output buffer., xrefs: 00007FF8B8B361A2

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Bytes_FromSizeStringmemcpy
String ID: Unable to allocate output buffer.
API String ID: 76732796-2565006440
Opcode ID: dfc50fe1e76f4b95923bb712c602e591bc04f2612fcca18cafc909a29d1c47b1
Instruction ID: bc5702a7e5b43ad0c56022cc6609e127dd7f40c5b56f955ff34a6fd7437325fd
Opcode Fuzzy Hash: dfc50fe1e76f4b95923bb712c602e591bc04f2612fcca18cafc909a29d1c47b1
Instruction Fuzzy Hash: 6C411872A99A0282EF1A8F6AD95026973A0FB48FD5F199432CF0D53755CF38E592C348

Function 00007FF8B8B3083C Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON312(?,?,?,00007FF8B8B3081A,?,?,?,?,?,00007FF8B8B307A5), ref: 00007FF8B8B30849

Part of subcall function 00007FF8B8B30970: PyLong_FromUnsignedLongLong.PYTHON312(?,?,?,00007FF8B8B3086D,?,?,?,00007FF8B8B3081A,?,?,?,?,?,00007FF8B8B307A5), ref: 00007FF8B8B30988
Part of subcall function 00007FF8B8B30970: PyUnicode_InternFromString.PYTHON312(?,?,?,00007FF8B8B3086D,?,?,?,00007FF8B8B3081A,?,?,?,?,?,00007FF8B8B307A5), ref: 00007FF8B8B30999
Part of subcall function 00007FF8B8B30970: PyDict_SetItem.PYTHON312(?,?,?,00007FF8B8B3086D,?,?,?,00007FF8B8B3081A,?,?,?,?,?,00007FF8B8B307A5), ref: 00007FF8B8B309B4

PyErr_Format.PYTHON312(?,?,?,00007FF8B8B3081A,?,?,?,?,?,00007FF8B8B307A5), ref: 00007FF8B8B35C50
_Py_Dealloc.PYTHON312(?,?,?,00007FF8B8B3081A,?,?,?,?,?,00007FF8B8B307A5), ref: 00007FF8B8B35C6C

Strings

dist, xrefs: 00007FF8B8B35C97
dict_size, xrefs: 00007FF8B8B30934
Invalid filter ID: %llu, xrefs: 00007FF8B8B35C43
start_offset, xrefs: 00007FF8B8B35C87

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Dict_FromLong$DeallocErr_FormatInternItemLong_StringUnicode_Unsigned
String ID: Invalid filter ID: %llu$dict_size$dist$start_offset
API String ID: 1484310907-3368833446
Opcode ID: 2bf5425971416fcf604516447e7ff1f6a8227c031248f9865350739be3ef4e27
Instruction ID: 2b9bd133e881f1cdf9dc0367d6bb1578e7524ab3e8291f47ee67079950694a60
Opcode Fuzzy Hash: 2bf5425971416fcf604516447e7ff1f6a8227c031248f9865350739be3ef4e27
Instruction Fuzzy Hash: EF41D831A88A0795FE648B3E994467833A0AF45BD4F448636CB1D466A4DF3CE4ABC709

Function 00007FF8B8CDAC10 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

PyObject_VectorcallMethod.PYTHON312 ref: 00007FF8B8CDAC40
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDAC8C
PyObject_Vectorcall.PYTHON312 ref: 00007FF8B8CDACD4
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDACEB
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDAD30

Part of subcall function 00007FF8B8CD3800: PyErr_Format.PYTHON312 ref: 00007FF8B8CD3834

Strings

eligible, xrefs: 00007FF8B8CDAD43
bool, xrefs: 00007FF8B8CDAC62, 00007FF8B8CDAD06

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Object_Vectorcall$Err_FormatMethod
String ID: bool$eligible
API String ID: 131476257-3320767611
Opcode ID: f397ca9387d6dfb1835b31036ec0af176946d4d6a5d65748a34c9214785249c7
Instruction ID: d6a17e272de75d8b7554696dc09a53c64253c6158e043ead89ff51a0e8fc713a
Opcode Fuzzy Hash: f397ca9387d6dfb1835b31036ec0af176946d4d6a5d65748a34c9214785249c7
Instruction Fuzzy Hash: 984165B1A0964282EBF09B1DE46827533A0EF447D5F485031DB5D06BA9DF2CF842CB08

Function 00007FF8B8B36380 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312(?,?,?,00007FF8B8B34D6B,?,?,?,00000000,?,?,?,00007FF8B8B28041), ref: 00007FF8B8B363B8
PyBytes_FromStringAndSize.PYTHON312(?,?,?,00007FF8B8B34D6B,?,?,?,00000000,?,?,?,00007FF8B8B28041), ref: 00007FF8B8B3641B
PyList_Append.PYTHON312(?,?,?,00007FF8B8B34D6B,?,?,?,00000000,?,?,?,00007FF8B8B28041), ref: 00007FF8B8B3642F
_Py_Dealloc.PYTHON312(?,?,?,00007FF8B8B34D6B,?,?,?,00000000,?,?,?,00007FF8B8B28041), ref: 00007FF8B8B3644B
_Py_Dealloc.PYTHON312(?,?,?,00007FF8B8B34D6B,?,?,?,00000000,?,?,?,00007FF8B8B28041), ref: 00007FF8B8B36464

Strings

avail_out is non-zero in _BlocksOutputBuffer_Grow()., xrefs: 00007FF8B8B363AE
Unable to allocate output buffer., xrefs: 00007FF8B8B3640D

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocString$AppendBytes_Err_FromList_Size
String ID: Unable to allocate output buffer.$avail_out is non-zero in _BlocksOutputBuffer_Grow().
API String ID: 1563898963-3455802345
Opcode ID: 580d003c13f45ba0d3f5d519e6676035726d1c9c5441bda9205d6986d50f6f75
Instruction ID: 3a2cc9425d2b1c9ad4d4d94bca0360b45008e669b3adf671072b53cb59ffec5d
Opcode Fuzzy Hash: 580d003c13f45ba0d3f5d519e6676035726d1c9c5441bda9205d6986d50f6f75
Instruction Fuzzy Hash: 54314921A98B4281EB148F3EE94412963A0FB49BE4F144235DB6E477E4DF7CE4468308

Function 00007FF8B8B295F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FF8B8B2961D
PyThread_release_lock.PYTHON312 ref: 00007FF8B8B29650
PyErr_SetString.PYTHON312 ref: 00007FF8B8B29685
PyEval_SaveThread.PYTHON312 ref: 00007FF8B8B350C6
PyThread_acquire_lock.PYTHON312 ref: 00007FF8B8B350DB
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B8B350E4

Strings

Already at end of stream, xrefs: 00007FF8B8B2967B

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$Err_RestoreSaveStringThread_release_lock
String ID: Already at end of stream
API String ID: 2195683152-1334556646
Opcode ID: 3eb67ee195b5bbe57a7cea297c8508a8a17e06b17122ceb0a36300f9ddcb8c56
Instruction ID: f27d66a96e54998ea34fa0193a27e2838c9e7b66d25858c58208546d49de9e9c
Opcode Fuzzy Hash: 3eb67ee195b5bbe57a7cea297c8508a8a17e06b17122ceb0a36300f9ddcb8c56
Instruction Fuzzy Hash: 1E111621A48E8285EB55DF6AE84416D67A5FB89FC1F484032DF0E57764CF3CE456C309

Function 00007FF8B8B29010 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312(?,?,?,00007FF8B8B28536), ref: 00007FF8B8B29036
PyThread_release_lock.PYTHON312(?,?,?,00007FF8B8B28536), ref: 00007FF8B8B29068
PyErr_SetString.PYTHON312(?,?,?,00007FF8B8B28536), ref: 00007FF8B8B29098

Part of subcall function 00007FF8B8B28564: PyType_GetModuleState.PYTHON312 ref: 00007FF8B8B2859D
Part of subcall function 00007FF8B8B28564: PyBytes_FromStringAndSize.PYTHON312 ref: 00007FF8B8B285B1
Part of subcall function 00007FF8B8B28564: PyList_New.PYTHON312 ref: 00007FF8B8B285C8
Part of subcall function 00007FF8B8B28564: PyEval_SaveThread.PYTHON312 ref: 00007FF8B8B28619
Part of subcall function 00007FF8B8B28564: PyEval_RestoreThread.PYTHON312 ref: 00007FF8B8B28633

PyEval_SaveThread.PYTHON312(?,?,?,00007FF8B8B28536), ref: 00007FF8B8B34F44
PyThread_acquire_lock.PYTHON312(?,?,?,00007FF8B8B28536), ref: 00007FF8B8B34F59
PyEval_RestoreThread.PYTHON312(?,?,?,00007FF8B8B28536), ref: 00007FF8B8B34F62

Strings

Compressor has been flushed, xrefs: 00007FF8B8B2908E

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
String ID: Compressor has been flushed
API String ID: 3871537485-3904734015
Opcode ID: 7a7077e9134b2479d70bc0b55754877c5396126443336fd8736004c065fe7fd0
Instruction ID: a502a7e3365aa4e20e641cd6fad1dc7d27ea5f547e4db444c40e97f1898c18a8
Opcode Fuzzy Hash: 7a7077e9134b2479d70bc0b55754877c5396126443336fd8736004c065fe7fd0
Instruction Fuzzy Hash: 1C114821A48A8682EB94CF3AE84466E6765FB88FC1F448032DF0E47B24CF3CE456C305

Function 00007FF8B8B32F1C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FF8B8B32F41
PyThread_release_lock.PYTHON312 ref: 00007FF8B8B32F7E
PyErr_SetString.PYTHON312 ref: 00007FF8B8B32FA8

Part of subcall function 00007FF8B8B28564: PyType_GetModuleState.PYTHON312 ref: 00007FF8B8B2859D
Part of subcall function 00007FF8B8B28564: PyBytes_FromStringAndSize.PYTHON312 ref: 00007FF8B8B285B1
Part of subcall function 00007FF8B8B28564: PyList_New.PYTHON312 ref: 00007FF8B8B285C8
Part of subcall function 00007FF8B8B28564: PyEval_SaveThread.PYTHON312 ref: 00007FF8B8B28619
Part of subcall function 00007FF8B8B28564: PyEval_RestoreThread.PYTHON312 ref: 00007FF8B8B28633

PyEval_SaveThread.PYTHON312 ref: 00007FF8B8B36274
PyThread_acquire_lock.PYTHON312 ref: 00007FF8B8B36289
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B8B36292

Strings

Repeated call to flush(), xrefs: 00007FF8B8B32F9E

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
String ID: Repeated call to flush()
API String ID: 3871537485-194442007
Opcode ID: a4197e1cdbd251bead5eb9b1989463c00a4a401fc08ccf7e864d5c68d6b91325
Instruction ID: 282742f185f92b9d6359792ae18044b8d03b3b05394b1869a73ca2cda2f74baf
Opcode Fuzzy Hash: a4197e1cdbd251bead5eb9b1989463c00a4a401fc08ccf7e864d5c68d6b91325
Instruction Fuzzy Hash: F4111C25A58A9282EA558B3AE84427E7365FF88FC1F048031DB0E47768CF7CE457C706

Function 00007FF8B93C6404 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312(?,?,?,00007FF8B93C5C98), ref: 00007FF8B93C6429
PyDict_GetItemWithError.PYTHON312(?,?,?,00007FF8B93C5C98), ref: 00007FF8B93C6436
PyErr_Occurred.PYTHON312(?,?,?,00007FF8B93C5C98), ref: 00007FF8B93C6441
PyModule_GetState.PYTHON312(?,?,?,00007FF8B93C5C98), ref: 00007FF8B93C644F
PyErr_Format.PYTHON312(?,?,?,00007FF8B93C5C98), ref: 00007FF8B93C6463
PyUnicode_AsUTF8.PYTHON312(?,?,?,00007FF8B93C5C98), ref: 00007FF8B93C6479

Strings

Unsupported digestmod %R, xrefs: 00007FF8B93C6458

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_Module_State$Dict_ErrorFormatItemOccurredUnicode_With
String ID: Unsupported digestmod %R
API String ID: 894184546-2483404930
Opcode ID: 4dc98bd10f6c1b0717930504ae7cb5ddadb8e86f017fbbcfe60b7e30e8aecefe
Instruction ID: 7bda0f4fefc72fbfb49121b9f6405a4326a00efda79c10cc8ea5cdd0f8654cb2
Opcode Fuzzy Hash: 4dc98bd10f6c1b0717930504ae7cb5ddadb8e86f017fbbcfe60b7e30e8aecefe
Instruction Fuzzy Hash: D4010C61B09F8395EA559F5AE54427B6671AF4CFD4F086039DE4E07761DE2CE4898300

Function 00007FF8B8CD6060 Relevance: 12.1, APIs: 8, Instructions: 60threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON312 ref: 00007FF8B8CD606D
_PyTrash_cond.PYTHON312 ref: 00007FF8B8CD607F
_PyThreadState_UncheckedGet.PYTHON312 ref: 00007FF8B8CD6089
_PyTrash_begin.PYTHON312 ref: 00007FF8B8CD6098
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD60C9
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD60F2
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD6114
_PyTrash_end.PYTHON312 ref: 00007FF8B8CD612F

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_beginTrash_condTrash_endUnchecked
String ID:
API String ID: 2819143443-0
Opcode ID: 1808094ad2c5952838fb359644ebaa2aa6756bbb3d9bb10f20ec9669fa938947
Instruction ID: 6291f9bada67e7132db9d121c1b8c2439789f80309d2539fdfac408b08ae61d9
Opcode Fuzzy Hash: 1808094ad2c5952838fb359644ebaa2aa6756bbb3d9bb10f20ec9669fa938947
Instruction Fuzzy Hash: 832121B590864281EBB55F69E56C77822A0EF48FE9F154234CB2D422D5CF3DE486C748

Function 00007FF8B8B28564 Relevance: 10.6, APIs: 7, Instructions: 125threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312 ref: 00007FF8B8B2859D
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FF8B8B285B1
PyList_New.PYTHON312 ref: 00007FF8B8B285C8
PyEval_SaveThread.PYTHON312 ref: 00007FF8B8B28619
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B8B28633
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B34DB2
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B34E04

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_ModuleRestoreSaveSizeStateStringType_
String ID:
API String ID: 2831925710-0
Opcode ID: cae30496bc2a9274937e9c345c6c18388f66ce03b5df9a1d955108f12d730ff2
Instruction ID: 777147fa0d8a4d6ad5a510d4ccd96c4a7b7e96aa29d03f229bf77e7cd6c20cb3
Opcode Fuzzy Hash: cae30496bc2a9274937e9c345c6c18388f66ce03b5df9a1d955108f12d730ff2
Instruction Fuzzy Hash: 6F516F22A49B5286EA658F39E94426D63A0FB58BD0F540235DFAD03B90DF3CE892C305

Function 00007FF8B8CDE1B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON312(?,?,?,?,?,00007FF8B8CD7DCE), ref: 00007FF8B8CDE24E
PyLong_FromSsize_t.PYTHON312(?,?,?,?,?,00007FF8B8CD7DCE), ref: 00007FF8B8CDE2AB
PyObject_RichCompareBool.PYTHON312(?,?,?,?,?,00007FF8B8CD7DCE), ref: 00007FF8B8CDE2C2
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8B8CD7DCE), ref: 00007FF8B8CDE2D8
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8B8CD7DCE), ref: 00007FF8B8CDE2EC

Strings

ratio, xrefs: 00007FF8B8CDE264

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$BoolCompareErr_FromLong_Object_OccurredRichSsize_t
String ID: ratio
API String ID: 2538524772-4234197119
Opcode ID: b6db84d1c7e11e830000ef7b1fab697241f009562e2efea8cddf9bf8aca289d7
Instruction ID: 8e1c1693ed23243d6ec68a5c3ee10c0d24efe381d827e8372ebdb2230f08d2cb
Opcode Fuzzy Hash: b6db84d1c7e11e830000ef7b1fab697241f009562e2efea8cddf9bf8aca289d7
Instruction Fuzzy Hash: E94171B2908A5286E7F1AB1D986827973A0AF49BD5F140230DB5C177A5DF3DF8438B48

Function 00007FF8B8CDF530 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON312(?,?,?,?,?,00007FF8B8CD8DEE), ref: 00007FF8B8CDF5CE
PyLong_FromSsize_t.PYTHON312(?,?,?,?,?,00007FF8B8CD8DEE), ref: 00007FF8B8CDF62B
PyObject_RichCompareBool.PYTHON312(?,?,?,?,?,00007FF8B8CD8DEE), ref: 00007FF8B8CDF642
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8B8CD8DEE), ref: 00007FF8B8CDF658
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8B8CD8DEE), ref: 00007FF8B8CDF66C

Strings

ratio, xrefs: 00007FF8B8CDF5E4

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$BoolCompareErr_FromLong_Object_OccurredRichSsize_t
String ID: ratio
API String ID: 2538524772-4234197119
Opcode ID: c6cb76a82c0156d83f652a4623d6809029c4d4441d1b486eb3f0817f7220173e
Instruction ID: d22aedbc3d279e6850a6bad5576dde07ed88df31342f35e9c05d9f2ecffdd055
Opcode Fuzzy Hash: c6cb76a82c0156d83f652a4623d6809029c4d4441d1b486eb3f0817f7220173e
Instruction Fuzzy Hash: 9F41A3A1D1864642E7B16F2D982827963A0BF49BD0F081231DF5D16AE5DF3DF8438B48

Function 00007FF8B8CD4FF0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD5012

Strings

attribute '_symbol_count' of 'TooManySymbolOrPunctuationPlugin' undefined, xrefs: 00007FF8B8CD5008
int, xrefs: 00007FF8B8CD5106
'TooManySymbolOrPunctuationPlugin' object attribute '_symbol_count' cannot be deleted, xrefs: 00007FF8B8CD507C

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_symbol_count' cannot be deleted$attribute '_symbol_count' of 'TooManySymbolOrPunctuationPlugin' undefined$int
API String ID: 1450464846-2291034628
Opcode ID: 005893139290546e466727384096f8c4c27f16b4c59161034916739a6ab1bdf9
Instruction ID: 8edad7822605596c78d8be04f66fae7431826fc3e80a482a00c4fddd18cca736
Opcode Fuzzy Hash: 005893139290546e466727384096f8c4c27f16b4c59161034916739a6ab1bdf9
Instruction Fuzzy Hash: B831A6B1B0850282EBB4AB2DE4BD2792390AF44BD0F585131DB5E477D9DF2DF8868B44

Function 00007FF8B8CD6190 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD61B2

Strings

attribute '_successive_count' of 'SuspiciousDuplicateAccentPlugin' undefined, xrefs: 00007FF8B8CD61A8
'SuspiciousDuplicateAccentPlugin' object attribute '_successive_count' cannot be deleted, xrefs: 00007FF8B8CD621C
int, xrefs: 00007FF8B8CD62A6

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'SuspiciousDuplicateAccentPlugin' object attribute '_successive_count' cannot be deleted$attribute '_successive_count' of 'SuspiciousDuplicateAccentPlugin' undefined$int
API String ID: 1450464846-1864222365
Opcode ID: 5778859781aa3561020ceb3b05ef8ae724d89a4ce4f3630b9ef98cc72eb7347a
Instruction ID: cd0d3c8cf29c1c39f4f21d3fd86ca1a242123e0d5f809998bf9ff10151b01d7b
Opcode Fuzzy Hash: 5778859781aa3561020ceb3b05ef8ae724d89a4ce4f3630b9ef98cc72eb7347a
Instruction Fuzzy Hash: F031A1A1F0850282EFB4AB2DE8B96782390AF44BD4F585131DB1D077D9DF2CE886CB44

Function 00007FF8B8CD85B0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD85D2

Strings

attribute '_successive_upper_lower_count_final' of 'ArchaicUpperLowerPlugin' undefined, xrefs: 00007FF8B8CD85C8
int, xrefs: 00007FF8B8CD86C6
'ArchaicUpperLowerPlugin' object attribute '_successive_upper_lower_count_final' cannot be deleted, xrefs: 00007FF8B8CD863C

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_successive_upper_lower_count_final' cannot be deleted$attribute '_successive_upper_lower_count_final' of 'ArchaicUpperLowerPlugin' undefined$int
API String ID: 1450464846-528010561
Opcode ID: 2ca47d72e77a7153c4af469a22f98ddc2045af71414dbb353d6064c52d0c80cb
Instruction ID: 56b34c10da366afae8814f1adda6e581a7deb3f18042cbdf101f7cb050b17012
Opcode Fuzzy Hash: 2ca47d72e77a7153c4af469a22f98ddc2045af71414dbb353d6064c52d0c80cb
Instruction Fuzzy Hash: 2C3172A1B0850282EBF4AB1DE4B92792390EF44BD4F585531EB2D067D4EF2DE4878B08

Function 00007FF8B8CD5B50 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD5B72

Strings

attribute '_unprintable_count' of 'UnprintablePlugin' undefined, xrefs: 00007FF8B8CD5B68
'UnprintablePlugin' object attribute '_unprintable_count' cannot be deleted, xrefs: 00007FF8B8CD5BDC
int, xrefs: 00007FF8B8CD5C66

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'UnprintablePlugin' object attribute '_unprintable_count' cannot be deleted$attribute '_unprintable_count' of 'UnprintablePlugin' undefined$int
API String ID: 1450464846-2997357838
Opcode ID: 05d8df805b557c735720644633408e4608b0fbfc31e106f8cc358c40349ee830
Instruction ID: 326250f2c3dedb6c9f15866737073ff8df1864f90571be04efa0efeccfd9ef47
Opcode Fuzzy Hash: 05d8df805b557c735720644633408e4608b0fbfc31e106f8cc358c40349ee830
Instruction Fuzzy Hash: 813194A1B0854292EFB4AB1DE4B92782390AF84BD4F585131DB1D077D4DF2DE887CB08

Function 00007FF8B8CD7B40 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD7B62

Strings

'CjkInvalidStopPlugin' object attribute '_wrong_stop_count' cannot be deleted, xrefs: 00007FF8B8CD7BCC
int, xrefs: 00007FF8B8CD7C56
attribute '_wrong_stop_count' of 'CjkInvalidStopPlugin' undefined, xrefs: 00007FF8B8CD7B58

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'CjkInvalidStopPlugin' object attribute '_wrong_stop_count' cannot be deleted$attribute '_wrong_stop_count' of 'CjkInvalidStopPlugin' undefined$int
API String ID: 1450464846-420147485
Opcode ID: d003440fe6475c9f59ed82b76a527c73c740b1cb598ce72131a3b28642e6cd38
Instruction ID: b772cdc4e415c056c8784d388a6f9c9166bc83fdb27536e24746f79762e534d2
Opcode Fuzzy Hash: d003440fe6475c9f59ed82b76a527c73c740b1cb598ce72131a3b28642e6cd38
Instruction Fuzzy Hash: 313165A1B0850295EBB4AB2DE4792792390AF44BD4F685131DB2D067D5DF3DE886CB08

Function 00007FF8B8CD7160 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD7182

Strings

'SuperWeirdWordPlugin' object attribute '_bad_word_count' cannot be deleted, xrefs: 00007FF8B8CD71EC
attribute '_bad_word_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF8B8CD7178
int, xrefs: 00007FF8B8CD7276

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_bad_word_count' cannot be deleted$attribute '_bad_word_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-3520798986
Opcode ID: 77c8772b984a2595aac65ff4e3f8c76f4f621aa382ae6883f4a9f238d60c89b9
Instruction ID: 4c0178da39cb9d7429cbcab1a3e6cebca2a1aae46303cb154840751494d00924
Opcode Fuzzy Hash: 77c8772b984a2595aac65ff4e3f8c76f4f621aa382ae6883f4a9f238d60c89b9
Instruction Fuzzy Hash: 4F3185A1F08542D2EBB4AB1DE47D27923A0AF44BD4F685131EB6D06795DF3CE4868B04

Function 00007FF8B8CD8B60 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD8B82

Strings

attribute '_character_count' of 'ArabicIsolatedFormPlugin' undefined, xrefs: 00007FF8B8CD8B78
'ArabicIsolatedFormPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8B8CD8BEC
int, xrefs: 00007FF8B8CD8C76

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'ArabicIsolatedFormPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'ArabicIsolatedFormPlugin' undefined$int
API String ID: 1450464846-3970786323
Opcode ID: 2e629f3262497ccb22304782c1099c2c36976ab49dc67f606c1b062756317bff
Instruction ID: cb68227e667842bf94e7a576b6ad13ad7aca24adb08e3fd4c6ad14b229c5008a
Opcode Fuzzy Hash: 2e629f3262497ccb22304782c1099c2c36976ab49dc67f606c1b062756317bff
Instruction Fuzzy Hash: 913183A1B0850691EFB4AB2DE8BD2782390EF84BD0F585531DB1D467D4DF2CE8878B08

Function 00007FF8B8CD7500 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD7522

Strings

attribute '_character_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF8B8CD7518
int, xrefs: 00007FF8B8CD7616
'SuperWeirdWordPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8B8CD758C

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-3920090044
Opcode ID: cd35c19dcae03a46ba023d8733dc0448e3e938908ebc375541851ad2aa41712c
Instruction ID: 802d362dc658ed36c9548bda5ec2d26a8e509a491ce3f5ae5f5f5888d8c99721
Opcode Fuzzy Hash: cd35c19dcae03a46ba023d8733dc0448e3e938908ebc375541851ad2aa41712c
Instruction Fuzzy Hash: 0F3198B1B0850286EBF4AB1DE47D2752390AF44BD4F585131EB2D06794EF3DE496CB05

Function 00007FF8B8CD5130 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD5152

Strings

attribute '_character_count' of 'TooManySymbolOrPunctuationPlugin' undefined, xrefs: 00007FF8B8CD5148
'TooManySymbolOrPunctuationPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8B8CD51BC
int, xrefs: 00007FF8B8CD5246

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'TooManySymbolOrPunctuationPlugin' undefined$int
API String ID: 1450464846-4240200891
Opcode ID: 536accf797a1bbe65dc8a4d75f5ab69cf8332c7d165fc34bcb50e14afcb09dcc
Instruction ID: 36dea6bccd24dc2655e47422481fe9b1c0ee11d9053a67b84972a870886c4c28
Opcode Fuzzy Hash: 536accf797a1bbe65dc8a4d75f5ab69cf8332c7d165fc34bcb50e14afcb09dcc
Instruction Fuzzy Hash: 3F3174A1F0854282EBB4AB1DE4792792360AF44BD4F585131DB1D477D9DF2CE886CB08

Function 00007FF8B8CD5730 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD5752

Strings

int, xrefs: 00007FF8B8CD5846
'TooManyAccentuatedPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8B8CD57BC
attribute '_character_count' of 'TooManyAccentuatedPlugin' undefined, xrefs: 00007FF8B8CD5748

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'TooManyAccentuatedPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'TooManyAccentuatedPlugin' undefined$int
API String ID: 1450464846-2022335554
Opcode ID: cef47ad94a8524b23c3b55ca13b9a14f862f4f76f789291d3bde506f314e6f26
Instruction ID: 7bf21b8604596828cc2c83bcd6abdcdf380b060271d8c27cafffdfe92e725e7e
Opcode Fuzzy Hash: cef47ad94a8524b23c3b55ca13b9a14f862f4f76f789291d3bde506f314e6f26
Instruction Fuzzy Hash: 6A3194A1F1850282EFB4AB2DE4792792390AF44BD1F585131DB2D477D5DF2CE886CB04

Function 00007FF8B8CD8330 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD8352

Strings

attribute '_character_count_since_last_sep' of 'ArchaicUpperLowerPlugin' undefined, xrefs: 00007FF8B8CD8348
int, xrefs: 00007FF8B8CD8446
'ArchaicUpperLowerPlugin' object attribute '_character_count_since_last_sep' cannot be deleted, xrefs: 00007FF8B8CD83BC

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_character_count_since_last_sep' cannot be deleted$attribute '_character_count_since_last_sep' of 'ArchaicUpperLowerPlugin' undefined$int
API String ID: 1450464846-2037488444
Opcode ID: 1006a038ca7837f55bf567080db1d952f620b641b4547de6e2a8b337716dbb5f
Instruction ID: c8ed4a6c86f5b76d73fc6b6a2f204253b42cfcc4f7ea39bcb714721e61bc6f47
Opcode Fuzzy Hash: 1006a038ca7837f55bf567080db1d952f620b641b4547de6e2a8b337716dbb5f
Instruction Fuzzy Hash: 4E3194A2B0854282EBB4AB2DE47D2792350FF48BD0F585531DB5D477D5DF2CE4868B08

Function 00007FF8B8CD62D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD62F2

Strings

'SuspiciousDuplicateAccentPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8B8CD635C
attribute '_character_count' of 'SuspiciousDuplicateAccentPlugin' undefined, xrefs: 00007FF8B8CD62E8
int, xrefs: 00007FF8B8CD63E6

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'SuspiciousDuplicateAccentPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'SuspiciousDuplicateAccentPlugin' undefined$int
API String ID: 1450464846-543361526
Opcode ID: 1291b6d293bf1ed5ae64a56b00bf1b13860b617c90494c0dd0123d29bd04fbc4
Instruction ID: 559ca9c3364dacb2bbc4f1aaa60fe4e0ffb671babaed3b2d6691819bc4fb27d2
Opcode Fuzzy Hash: 1291b6d293bf1ed5ae64a56b00bf1b13860b617c90494c0dd0123d29bd04fbc4
Instruction Fuzzy Hash: FD31C7B2B0850282EBB4AB2DE47C6B923A0AF44BD4F485131DB5D477D4DF2CE496CB04

Function 00007FF8B8CD86F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD8712

Strings

'ArchaicUpperLowerPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8B8CD877C
attribute '_character_count' of 'ArchaicUpperLowerPlugin' undefined, xrefs: 00007FF8B8CD8708
int, xrefs: 00007FF8B8CD8806

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'ArchaicUpperLowerPlugin' undefined$int
API String ID: 1450464846-4184598959
Opcode ID: 342a4cd3f7d259d24aeb9a776a1e708ee513c6b05d4146dbb2a3107d3dc6b54c
Instruction ID: af4f7f8ff546029a90f6bc8f4cb6d3b77fe976e38e8b881d169987c0f7a14452
Opcode Fuzzy Hash: 342a4cd3f7d259d24aeb9a776a1e708ee513c6b05d4146dbb2a3107d3dc6b54c
Instruction Fuzzy Hash: 863174A1F0850285EBF4AB2DE4B92792390EF44BD4F585531EB1D4B795DF2CE886CB08

Function 00007FF8B8CD66E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD6702

Strings

attribute '_suspicious_successive_range_count' of 'SuspiciousRange' undefined, xrefs: 00007FF8B8CD66F8
'SuspiciousRange' object attribute '_suspicious_successive_range_count' cannot be deleted, xrefs: 00007FF8B8CD676C
int, xrefs: 00007FF8B8CD67F6

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'SuspiciousRange' object attribute '_suspicious_successive_range_count' cannot be deleted$attribute '_suspicious_successive_range_count' of 'SuspiciousRange' undefined$int
API String ID: 1450464846-916769388
Opcode ID: 32c8cc5da1c5a4c53662f2a02eb56b9d7fcea26900f0b6a46b27aacae368bd4d
Instruction ID: 39d56147c21b108cd77bb4ffe626303043a1f6b2442d2f12a327f404bf2f2ccc
Opcode Fuzzy Hash: 32c8cc5da1c5a4c53662f2a02eb56b9d7fcea26900f0b6a46b27aacae368bd4d
Instruction Fuzzy Hash: AD3192E1F0850682EBB4AB2DE4BD6782390AF44BD4F595131DB1D0A7D5DF2CE886CB44

Function 00007FF8B8CD5C90 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD5CB2

Strings

'UnprintablePlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8B8CD5D1C
attribute '_character_count' of 'UnprintablePlugin' undefined, xrefs: 00007FF8B8CD5CA8
int, xrefs: 00007FF8B8CD5DA6

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'UnprintablePlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'UnprintablePlugin' undefined$int
API String ID: 1450464846-2596148235
Opcode ID: 073f5d8d8577f69fc90c9a8fdde1e95b02313488756eee5ef187c2381a1a2916
Instruction ID: cf47988b2120d40b6e74530fb26273eb28d7cdd2fb0b71dca3594f0ac5c7aed0
Opcode Fuzzy Hash: 073f5d8d8577f69fc90c9a8fdde1e95b02313488756eee5ef187c2381a1a2916
Instruction Fuzzy Hash: 813183A1F0850292EBB4AB2DE47D2B82360AF44BD4F584131DB5D07798DF2CE8868B14

Function 00007FF8B8CD7C80 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD7CA2

Strings

'CjkInvalidStopPlugin' object attribute '_cjk_character_count' cannot be deleted, xrefs: 00007FF8B8CD7D0C
attribute '_cjk_character_count' of 'CjkInvalidStopPlugin' undefined, xrefs: 00007FF8B8CD7C98
int, xrefs: 00007FF8B8CD7D96

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'CjkInvalidStopPlugin' object attribute '_cjk_character_count' cannot be deleted$attribute '_cjk_character_count' of 'CjkInvalidStopPlugin' undefined$int
API String ID: 1450464846-399339277
Opcode ID: f2c272c237092df4c159db7bbb8ebb4d417ee1358fd08bf9141b406699d39ed6
Instruction ID: adaf5f5da29c097345e952492253e057351886b87cde5bf593b9e64ae98ea8ad
Opcode Fuzzy Hash: f2c272c237092df4c159db7bbb8ebb4d417ee1358fd08bf9141b406699d39ed6
Instruction Fuzzy Hash: 173194A1B0850286EBB4AB2DE47D2B82350AF84BD4F685131DB6D077D9DF3DE486CB04

Function 00007FF8B8CD4EB0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD4ED2

Strings

'TooManySymbolOrPunctuationPlugin' object attribute '_punctuation_count' cannot be deleted, xrefs: 00007FF8B8CD4F3C
attribute '_punctuation_count' of 'TooManySymbolOrPunctuationPlugin' undefined, xrefs: 00007FF8B8CD4EC8
int, xrefs: 00007FF8B8CD4FC6

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_punctuation_count' cannot be deleted$attribute '_punctuation_count' of 'TooManySymbolOrPunctuationPlugin' undefined$int
API String ID: 1450464846-1459665959
Opcode ID: 524d028e614f50b41909a65e2b05ff1c14cbdfe08726ae935d08e3c758078267
Instruction ID: d42dd286f0c263e671afff36eee27239c5087a45da4e48de546b3862e36df317
Opcode Fuzzy Hash: 524d028e614f50b41909a65e2b05ff1c14cbdfe08726ae935d08e3c758078267
Instruction Fuzzy Hash: 913185A1B0850292EBB4AB2DE4BD2786390AF44BD0F585131DB1D077E5DF2DE8868B04

Function 00007FF8B8CD72A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD72C2

Strings

'SuperWeirdWordPlugin' object attribute '_foreign_long_count' cannot be deleted, xrefs: 00007FF8B8CD732C
attribute '_foreign_long_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF8B8CD72B8
int, xrefs: 00007FF8B8CD73B6

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_foreign_long_count' cannot be deleted$attribute '_foreign_long_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-3135691889
Opcode ID: 35cb3d4f2bd9c4a5d37c2cde372bddb3ca93a0b263ca3f3a2d664a0bc4599930
Instruction ID: f1df7650833f4a15a01d6b0a0129cf5629df77e78af9f95410707f13b06c1fff
Opcode Fuzzy Hash: 35cb3d4f2bd9c4a5d37c2cde372bddb3ca93a0b263ca3f3a2d664a0bc4599930
Instruction Fuzzy Hash: F13196A2B08542C1EBB4AB1DE4B927823A0AF44BD0F685131DB2D47794DF3DE886CB04

Function 00007FF8B8CD8CA0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD8CC2

Strings

int, xrefs: 00007FF8B8CD8DB6
attribute '_isolated_form_count' of 'ArabicIsolatedFormPlugin' undefined, xrefs: 00007FF8B8CD8CB8
'ArabicIsolatedFormPlugin' object attribute '_isolated_form_count' cannot be deleted, xrefs: 00007FF8B8CD8D2C

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'ArabicIsolatedFormPlugin' object attribute '_isolated_form_count' cannot be deleted$attribute '_isolated_form_count' of 'ArabicIsolatedFormPlugin' undefined$int
API String ID: 1450464846-4047731557
Opcode ID: 1ec334efbc93af8a0daa537c9c947367f6496fe570f3d383ebc24800b9db443f
Instruction ID: 360cf49a2a95cfad95846d30386e3499fe6a368850179b4d730c3e6a14ee9e2f
Opcode Fuzzy Hash: 1ec334efbc93af8a0daa537c9c947367f6496fe570f3d383ebc24800b9db443f
Instruction Fuzzy Hash: 633185A1B0850282EBB4AB1DE4792B823A0EF54BD4F584531DB5D077D4DF2DE4868B08

Function 00007FF8B8CD7640 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD7662

Strings

attribute '_bad_character_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF8B8CD7658
'SuperWeirdWordPlugin' object attribute '_bad_character_count' cannot be deleted, xrefs: 00007FF8B8CD76CC
int, xrefs: 00007FF8B8CD7756

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_bad_character_count' cannot be deleted$attribute '_bad_character_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-2709777744
Opcode ID: 610f13cc42156de412b3f6d1ccc7dde81ee8bb81fe19c5e5436d4dfc6cd023cb
Instruction ID: 35803edee3fda95e4c3d9cc33af676ade2c9253e8d70ae654fd671862f44a645
Opcode Fuzzy Hash: 610f13cc42156de412b3f6d1ccc7dde81ee8bb81fe19c5e5436d4dfc6cd023cb
Instruction Fuzzy Hash: 1A3183A1B0850282EBB5AB2DE4792B82390AF44BD4F685131DB2D077D4EF3DE4978B04

Function 00007FF8B8CD5870 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD5892

Strings

'TooManyAccentuatedPlugin' object attribute '_accentuated_count' cannot be deleted, xrefs: 00007FF8B8CD58FC
attribute '_accentuated_count' of 'TooManyAccentuatedPlugin' undefined, xrefs: 00007FF8B8CD5888
int, xrefs: 00007FF8B8CD5986

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'TooManyAccentuatedPlugin' object attribute '_accentuated_count' cannot be deleted$attribute '_accentuated_count' of 'TooManyAccentuatedPlugin' undefined$int
API String ID: 1450464846-3693778415
Opcode ID: 7f11271614b407e1cd5d041de6a849fa1ce6af29865a2d7861870a54299a5fe4
Instruction ID: 822fa13ad6e037e326ecec1694318edcb2953cb211a199919b2fec899433e74e
Opcode Fuzzy Hash: 7f11271614b407e1cd5d041de6a849fa1ce6af29865a2d7861870a54299a5fe4
Instruction Fuzzy Hash: EF3174A2F0850282EBB4AB1DE8B92792350AF44BE0F585131DB6D477D5DF2CE8978B04

Function 00007FF8B8CD8470 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD8492

Strings

attribute '_successive_upper_lower_count' of 'ArchaicUpperLowerPlugin' undefined, xrefs: 00007FF8B8CD8488
'ArchaicUpperLowerPlugin' object attribute '_successive_upper_lower_count' cannot be deleted, xrefs: 00007FF8B8CD84FC
int, xrefs: 00007FF8B8CD8586

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_successive_upper_lower_count' cannot be deleted$attribute '_successive_upper_lower_count' of 'ArchaicUpperLowerPlugin' undefined$int
API String ID: 1450464846-634379450
Opcode ID: 3342e34050822ecdd092d2c1701ec675c9b80d10f8f017621af40ec443b25660
Instruction ID: a769a5252babc1be824a755f6472acee562768a0ac38ea2039aeaed60dd7527e
Opcode Fuzzy Hash: 3342e34050822ecdd092d2c1701ec675c9b80d10f8f017621af40ec443b25660
Instruction Fuzzy Hash: 253196A1B0850282EFB4AB1DE47D27923A0EF44BD0F585531EB1D077D5EF2CE4968B08

Function 00007FF8B8CD7860 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD7882

Strings

attribute '_buffer_accent_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF8B8CD7878
int, xrefs: 00007FF8B8CD7976
'SuperWeirdWordPlugin' object attribute '_buffer_accent_count' cannot be deleted, xrefs: 00007FF8B8CD78EC

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_buffer_accent_count' cannot be deleted$attribute '_buffer_accent_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-76466605
Opcode ID: 20ea869bad6b8ed73006467498f91221eb8f9dd8b91723df2faa57ca20f3ad29
Instruction ID: 6d2a267eeed4e671efff8cb39ebca00db8c9f7ed7327a7e18ba6cdeaeb06ec1b
Opcode Fuzzy Hash: 20ea869bad6b8ed73006467498f91221eb8f9dd8b91723df2faa57ca20f3ad29
Instruction Fuzzy Hash: 6C3183A2B0850282EBB4AB2DE47D2B92350AF44BD0F685131DB6D077D5DF3DE496CB08

Function 00007FF8B8CD6820 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD6842

Strings

attribute '_character_count' of 'SuspiciousRange' undefined, xrefs: 00007FF8B8CD6838
'SuspiciousRange' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8B8CD68AC
int, xrefs: 00007FF8B8CD6936

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'SuspiciousRange' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'SuspiciousRange' undefined$int
API String ID: 1450464846-3882440367
Opcode ID: edf70cb319030b3d86d441b19e0745afc740f480ca4045dac8bdcfc512da58eb
Instruction ID: a725ce21d4430427f0042053d0647fc4ca4df4485bf83f2f5d9356872f3c5399
Opcode Fuzzy Hash: edf70cb319030b3d86d441b19e0745afc740f480ca4045dac8bdcfc512da58eb
Instruction Fuzzy Hash: B131A3A1B0850282EBF4AB1DE87D67823A0AF44BD4F584131DB5D07794EF2CE486CB04

Function 00007FF8B8CD7020 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD7042

Strings

attribute '_word_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF8B8CD7038
'SuperWeirdWordPlugin' object attribute '_word_count' cannot be deleted, xrefs: 00007FF8B8CD70AC
int, xrefs: 00007FF8B8CD7136

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_word_count' cannot be deleted$attribute '_word_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-1212817586
Opcode ID: 16b82e3689da71a62fdb9f4fcb28de3a703054875de315429c3694e8e6cd4c3d
Instruction ID: 32f7ba132d68e2b6ddda3442e6f277fb4a75863c9a704cf2034bb34dc621819f
Opcode Fuzzy Hash: 16b82e3689da71a62fdb9f4fcb28de3a703054875de315429c3694e8e6cd4c3d
Instruction Fuzzy Hash: DA3163A1F0850282EBB4AB2DE4B92792350AF44BD4F685131DB2D077D5DF3DE886CB04

Function 00007FF8B8CDDED0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

PySet_Contains.PYTHON312 ref: 00007FF8B8CDDEEC
PyObject_Vectorcall.PYTHON312 ref: 00007FF8B8CDDF38
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDDF4F
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDDF94

Part of subcall function 00007FF8B8CD2920: PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD2961
Part of subcall function 00007FF8B8CD2920: PyNumber_Add.PYTHON312 ref: 00007FF8B8CD29B7
Part of subcall function 00007FF8B8CD2920: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD29D7
Part of subcall function 00007FF8B8CD2920: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD29EB

Part of subcall function 00007FF8B8CD2920: PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD299F
Part of subcall function 00007FF8B8CD2920: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD2A2D

Strings

feed, xrefs: 00007FF8B8CDDFAD
bool, xrefs: 00007FF8B8CDDF6A

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$ContainsNumber_Object_Set_Vectorcall
String ID: bool$feed
API String ID: 3415927029-2849697477
Opcode ID: eb45302e3cef5080e95074768180575d99dfa37b4141d0cc9422c2bb42ee7491
Instruction ID: b8e03207f249c9ecd077eb3f57aa50130273351548972f2b39ea4c896a931714
Opcode Fuzzy Hash: eb45302e3cef5080e95074768180575d99dfa37b4141d0cc9422c2bb42ee7491
Instruction Fuzzy Hash: 224121A1E18A4283EBB1AF1DF46927A63A0EF447C5F445035DB5D07B59DF2CF4428B18

Function 00007FF8B8CD6CF0 Relevance: 10.6, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD6D1C
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD6D45
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD6D6E
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD6D97
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD6DC0
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD6DE2
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD6E0B

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: 527074c6cd195ab482c56603e858959c90a590d2c84401fac90cb2060dcc2367
Instruction ID: ece963cb82e0f21680601544e6d0335c89601dffa42348e214291f5f5fa769a5
Opcode Fuzzy Hash: 527074c6cd195ab482c56603e858959c90a590d2c84401fac90cb2060dcc2367
Instruction Fuzzy Hash: 2341D9B6908A0181EBB55F3CE86C76822A0AF55BBDF140335CB79451D4CF7DA886C784

Function 00007FF8B93C3980 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FF8B93C399A
_Py_hashtable_destroy.PYTHON312 ref: 00007FF8B93C3A2B
_Py_Dealloc.PYTHON312 ref: 00007FF8B93C3A42
_Py_Dealloc.PYTHON312 ref: 00007FF8B93C3A4A
_Py_Dealloc.PYTHON312 ref: 00007FF8B93C54FC

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Module_Py_hashtable_destroyState
String ID:
API String ID: 3151084188-0
Opcode ID: aec7e81a30017dfb9860732021c0e12118c16824c1734b799b247b0a465272df
Instruction ID: d97d6e362511cb60a6c11366f41a182ec095d40fc6577de0f67a2caf1921ecbd
Opcode Fuzzy Hash: aec7e81a30017dfb9860732021c0e12118c16824c1734b799b247b0a465272df
Instruction Fuzzy Hash: F831163690EF8282EB6A8F2D985417A72B4EF4CFD5B286530CB4E06651CF3EA459C350

Function 00007FF8B8CD5630 Relevance: 10.6, APIs: 7, Instructions: 51threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON312 ref: 00007FF8B8CD563D
_PyTrash_cond.PYTHON312 ref: 00007FF8B8CD564F
_PyThreadState_UncheckedGet.PYTHON312 ref: 00007FF8B8CD5659
_PyTrash_begin.PYTHON312 ref: 00007FF8B8CD5668
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD5695
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD56BE
_PyTrash_end.PYTHON312 ref: 00007FF8B8CD56D9

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_beginTrash_condTrash_endUnchecked
String ID:
API String ID: 2819143443-0
Opcode ID: 1c16e7615a0f82207d80faaa12bf775c49de3bd6999ef687b31fc543c5e7b3c6
Instruction ID: 6776ddcbc9b1bd1f21c8efa5cd55f435bce6341d01bf166e2c33cf361027f64d
Opcode Fuzzy Hash: 1c16e7615a0f82207d80faaa12bf775c49de3bd6999ef687b31fc543c5e7b3c6
Instruction Fuzzy Hash: FE2100B590860282EBB59F39956C33822A0EF54FEAF154230DB2D467E4CF7CE8478B44

Function 00007FF8B8B31F4C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FF8B8B31F88
PyMem_Calloc.PYTHON312 ref: 00007FF8B8B31F9A
PyErr_SetString.PYTHON312 ref: 00007FF8B8B31FCB
PyErr_NoMemory.PYTHON312 ref: 00007FF8B8B31FD5

Strings

Invalid filter specifier for delta filter, xrefs: 00007FF8B8B31FC1
|OO&, xrefs: 00007FF8B8B31F79

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Err_$Arg_CallocKeywords_Mem_MemoryParseSizeStringTuple
String ID: Invalid filter specifier for delta filter$|OO&
API String ID: 3027669873-2010576982
Opcode ID: 8f6d3e53a03bcdfc1a1c4549eb233bcc7dd316073f513c0d7cf3946cf18a22e7
Instruction ID: 45f678ad8b1da172df7c28cae4b9a92573c3ea467e08e326020a94f4e897c00b
Opcode Fuzzy Hash: 8f6d3e53a03bcdfc1a1c4549eb233bcc7dd316073f513c0d7cf3946cf18a22e7
Instruction Fuzzy Hash: D8110575A89A0396EB008B39E8541AD73B8FB48B95F508136DB0D43360DF7DE40BC759

Function 00007FF8B8B31EC0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FF8B8B31EF9
PyMem_Calloc.PYTHON312 ref: 00007FF8B8B31F0B
PyErr_SetString.PYTHON312 ref: 00007FF8B8B31F38
PyErr_NoMemory.PYTHON312 ref: 00007FF8B8B31F42

Strings

Invalid filter specifier for BCJ filter, xrefs: 00007FF8B8B31F2E
|OO&, xrefs: 00007FF8B8B31EDF

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Err_$Arg_CallocKeywords_Mem_MemoryParseSizeStringTuple
String ID: Invalid filter specifier for BCJ filter$|OO&
API String ID: 3027669873-3728029529
Opcode ID: c99a539e3f84903be04565e407b851ab502a56b26a5fb183a3bd791a404fbe6a
Instruction ID: e2c8cba06e13693c27df03165496e5eae38f1afce54ac675030f48d5800c7414
Opcode Fuzzy Hash: c99a539e3f84903be04565e407b851ab502a56b26a5fb183a3bd791a404fbe6a
Instruction Fuzzy Hash: 7A011375A88B0296EB00CB39E8441AD33A8FB48B81F500032EB0D43360EF7CE40BC359

Function 00007FF8B8CD2CB0 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD2D16
PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD2D42
PyNumber_Remainder.PYTHON312 ref: 00007FF8B8CD2D5F
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD2D76
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD2D8A
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD2DE4

Part of subcall function 00007FF8B8CD3590: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FF8B8CD28DB), ref: 00007FF8B8CD3599
Part of subcall function 00007FF8B8CD3590: fprintf.MSPDB140-MSVCRT ref: 00007FF8B8CD35A9
Part of subcall function 00007FF8B8CD3590: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FF8B8CD28DB), ref: 00007FF8B8CD35B3
Part of subcall function 00007FF8B8CD3590: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FF8B8CD28DB), ref: 00007FF8B8CD35BC
Part of subcall function 00007FF8B8CD3590: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8B8CD28DB), ref: 00007FF8B8CD35C2

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t__acrt_iob_func$Number_Remainderabortfflushfprintf
String ID:
API String ID: 1333916573-0
Opcode ID: 1ff0950ba76d1fb5de8f3a40737609fc14ed6e45cecf514f6e3c309322584276
Instruction ID: 490d343d0f68f1e2a40b83a91c2d903e76380dba07bf437b1896dc6a3693cb92
Opcode Fuzzy Hash: 1ff0950ba76d1fb5de8f3a40737609fc14ed6e45cecf514f6e3c309322584276
Instruction Fuzzy Hash: BF4193B1A0854352EBB55F1DA5682386290AF48BE1F484130DF6D477D8DF2CF843CB08

Function 00007FF8B8CD2B70 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD2BCC
PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD2BF8
PyNumber_Multiply.PYTHON312 ref: 00007FF8B8CD2C10
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD2C30
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD2C44
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD2C86

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$MultiplyNumber_
String ID:
API String ID: 3214704217-0
Opcode ID: e441c8e1654ce7b2f422eefc1750921705619e20d6a3389d9b7057bf79d9000f
Instruction ID: 77bd6e4866743454730cd940dc1c1b187af7cd109ab4be13157b63f1eaa4d4e2
Opcode Fuzzy Hash: e441c8e1654ce7b2f422eefc1750921705619e20d6a3389d9b7057bf79d9000f
Instruction Fuzzy Hash: AD3145B1A0960392FBB45F1DA5683786290AF85BE5F085130DB2E477D8DF6CF8538B08

Function 00007FF8B8CD2920 Relevance: 9.1, APIs: 6, Instructions: 91COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD2961
PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD299F
PyNumber_Add.PYTHON312 ref: 00007FF8B8CD29B7
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD29D7
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD29EB
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD2A2D

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$Number_
String ID:
API String ID: 4245833954-0
Opcode ID: ae72d080b4b55a948d5582023073e92d7aff9d277a6dfd1cb9816ae3c140e2c2
Instruction ID: 12b0852a6b6ebba2db445e4b0ffbfc41f464e1df6eed3f85382b16871be28d18
Opcode Fuzzy Hash: ae72d080b4b55a948d5582023073e92d7aff9d277a6dfd1cb9816ae3c140e2c2
Instruction Fuzzy Hash: 473172B2A08A4396EBB45F1995782786290EF44BE5F045130DB6D067D9DF2CF4438B04

Function 00007FF8B8CD2A50 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD2A85
PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD2ABF
PyNumber_Subtract.PYTHON312 ref: 00007FF8B8CD2AD7
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD2AF7
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD2B0B
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD2B4D

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$Number_Subtract
String ID:
API String ID: 2424657569-0
Opcode ID: aeebb34f4fc22b334b36647e21926670cdad37f7e6ebb6e2507bbb1c10b61d03
Instruction ID: 0699e2c6fd938e7e15ef26fcc511a8782a07231637b647116b4621c8249712ea
Opcode Fuzzy Hash: aeebb34f4fc22b334b36647e21926670cdad37f7e6ebb6e2507bbb1c10b61d03
Instruction Fuzzy Hash: 7D31B072A08A43A2EBB49F19E46837963A0EF48BD1F445031DF1E07799DF6CF4428B08

Function 00007FF8B93C3810 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

_Py_hashtable_new_full.PYTHON312 ref: 00007FF8B93C3837
PyMem_Malloc.PYTHON312 ref: 00007FF8B93C3869
_Py_hashtable_set.PYTHON312 ref: 00007FF8B93C389A
_Py_hashtable_set.PYTHON312 ref: 00007FF8B93C38C0
PyMem_Free.PYTHON312 ref: 00007FF8B93C54E5
_Py_hashtable_destroy.PYTHON312 ref: 00007FF8B93C54EE

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Mem_Py_hashtable_set$FreeMallocPy_hashtable_destroyPy_hashtable_new_full
String ID:
API String ID: 3987031744-0
Opcode ID: 521a36c4736dcf530351517d68e1637d5f594c99e23ced191db7d41f4f9a780d
Instruction ID: 13cc97be8012798d24d692a5185c92cc6bddd35ab2847b32335483053a6a164b
Opcode Fuzzy Hash: 521a36c4736dcf530351517d68e1637d5f594c99e23ced191db7d41f4f9a780d
Instruction Fuzzy Hash: 4121D526A1DF8692EA119F29D9043BAA3B0FF58BC4F046135CF4E12664DF2CE59DC300

Function 00007FF8B8B30970 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

PyLong_FromUnsignedLongLong.PYTHON312(?,?,?,00007FF8B8B3086D,?,?,?,00007FF8B8B3081A,?,?,?,?,?,00007FF8B8B307A5), ref: 00007FF8B8B30988
PyUnicode_InternFromString.PYTHON312(?,?,?,00007FF8B8B3086D,?,?,?,00007FF8B8B3081A,?,?,?,?,?,00007FF8B8B307A5), ref: 00007FF8B8B30999
PyDict_SetItem.PYTHON312(?,?,?,00007FF8B8B3086D,?,?,?,00007FF8B8B3081A,?,?,?,?,?,00007FF8B8B307A5), ref: 00007FF8B8B309B4
_Py_Dealloc.PYTHON312(?,?,?,00007FF8B8B3086D,?,?,?,00007FF8B8B3081A,?,?,?,?,?,00007FF8B8B307A5), ref: 00007FF8B8B35CBE
_Py_Dealloc.PYTHON312(?,?,?,00007FF8B8B3086D,?,?,?,00007FF8B8B3081A,?,?,?,?,?,00007FF8B8B307A5), ref: 00007FF8B8B35CD7

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocFromLong$Dict_InternItemLong_StringUnicode_Unsigned
String ID:
API String ID: 252187852-0
Opcode ID: 4407cb7e2ae5907235722564fec9c5a3f52f4cf3bc80c1b274a729e09646330d
Instruction ID: 67e656920fc49cb14d7912c7fb60a5cdb20beae0fdcb0fd377dbee40b1ee8962
Opcode Fuzzy Hash: 4407cb7e2ae5907235722564fec9c5a3f52f4cf3bc80c1b274a729e09646330d
Instruction Fuzzy Hash: A7114F31E8CA4282FE154B3DA91423D7290AF49BD5F085131DB4E52794DF7CE847C309

Function 00007FF8B93C2A60 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

EVP_MD_CTX_copy.LIBCRYPTO-3(?,?,00000000,00007FF8B93C284C), ref: 00007FF8B93C2A85
PyThread_acquire_lock.PYTHON312(?,?,00000000,00007FF8B93C284C), ref: 00007FF8B93C2AA8
PyThread_release_lock.PYTHON312(?,?,00000000,00007FF8B93C284C), ref: 00007FF8B93C2AB7
PyEval_SaveThread.PYTHON312(?,?,00000000,00007FF8B93C284C), ref: 00007FF8B93C543C
PyThread_acquire_lock.PYTHON312(?,?,00000000,00007FF8B93C284C), ref: 00007FF8B93C544E
PyEval_RestoreThread.PYTHON312(?,?,00000000,00007FF8B93C284C), ref: 00007FF8B93C5457

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$RestoreSaveThread_release_lockX_copy
String ID:
API String ID: 1756194536-0
Opcode ID: a4ee6c14de5c42901d50f3f27420606cf0550f6fc93f8eeac909ef395a64bc57
Instruction ID: d399f53689ff432b0734ba95421b8ebf078c0de2970958888f9fb37055d2b1f7
Opcode Fuzzy Hash: a4ee6c14de5c42901d50f3f27420606cf0550f6fc93f8eeac909ef395a64bc57
Instruction Fuzzy Hash: 8B01CC25A0CF8282EA249F6AA59413A2371BF9CFD5F146431EE0F43764DE3CD4598741

Function 00007FF8B8CD3080 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

PyUnicode_New.PYTHON312 ref: 00007FF8B8CD30FF
PyErr_SetString.PYTHON312 ref: 00007FF8B8CD31E4
PyErr_SetString.PYTHON312 ref: 00007FF8B8CD3207

Strings

string index out of range, xrefs: 00007FF8B8CD31DA
Python int too large to convert to C ssize_t, xrefs: 00007FF8B8CD31FD

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String$Unicode_
String ID: Python int too large to convert to C ssize_t$string index out of range
API String ID: 2250126396-644864186
Opcode ID: e36458edd2254e28eaa8631afe286072e5f7bd0a67a5b6a46e6ef0c44dcb495f
Instruction ID: 8b7a93a00d60255c8b65140f8cb86765d24babc75d916d38b4229360c73c64ce
Opcode Fuzzy Hash: e36458edd2254e28eaa8631afe286072e5f7bd0a67a5b6a46e6ef0c44dcb495f
Instruction Fuzzy Hash: 7341B7A6B0550282EFB49F2ED4A52B927A0FBC8B84FC81075CB4E43791DF2DD546CB04

Function 00007FF8B8B30A68 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

PySequence_Size.PYTHON312(00000000,?,00000000,00007FF8B8B30A18), ref: 00007FF8B8B30A94
PySequence_GetItem.PYTHON312(?,00000000,00007FF8B8B30A18), ref: 00007FF8B8B30AC7

Part of subcall function 00007FF8B8B30B5C: PyMapping_Check.PYTHON312(?,?,?,00000028,00007FF8B8B30AE3,?,00000000,00007FF8B8B30A18), ref: 00007FF8B8B30B81
Part of subcall function 00007FF8B8B30B5C: PyMapping_GetItemString.PYTHON312(?,?,?,00000028,00007FF8B8B30AE3,?,00000000,00007FF8B8B30A18), ref: 00007FF8B8B30B9B
Part of subcall function 00007FF8B8B30B5C: PyLong_AsUnsignedLongLong.PYTHON312(?,?,?,00000028,00007FF8B8B30AE3,?,00000000,00007FF8B8B30A18), ref: 00007FF8B8B30BB0
Part of subcall function 00007FF8B8B30B5C: PyErr_Occurred.PYTHON312(?,?,?,00000028,00007FF8B8B30AE3,?,00000000,00007FF8B8B30A18), ref: 00007FF8B8B30BC7

PyErr_Format.PYTHON312(?,00000000,00007FF8B8B30A18), ref: 00007FF8B8B35D09

Strings

Too many filters - liblzma supports a maximum of %d, xrefs: 00007FF8B8B35CF9

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Err_ItemLongMapping_Sequence_$CheckFormatLong_OccurredSizeStringUnsigned
String ID: Too many filters - liblzma supports a maximum of %d
API String ID: 1062705235-2617632755
Opcode ID: ccf5a64d07049f618c25ab74cbb4974c3106e7c7554985af56aab865a0a260af
Instruction ID: 693caa505497fe398eb64e493f4f4f6a5fc286e553682f6862806f1e5a37556f
Opcode Fuzzy Hash: ccf5a64d07049f618c25ab74cbb4974c3106e7c7554985af56aab865a0a260af
Instruction Fuzzy Hash: 54316721B88A1285EE649B3AA8002397690AF45BF8F184331DF3D177D5EF3CE0438708

Function 00007FF8B8CD2F90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD2FB6

Strings

division by zero, xrefs: 00007FF8B8CD2FAC

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: division by zero
API String ID: 1450464846-3764743415
Opcode ID: 1f310e5c3776cb982e72da88537671f8547cf76eb46f26856b816b508ecd4924
Instruction ID: 65f52c46a005876033e20797e4a546f63608f29e1fd5a8c881d48f14d7bcf5f6
Opcode Fuzzy Hash: 1f310e5c3776cb982e72da88537671f8547cf76eb46f26856b816b508ecd4924
Instruction Fuzzy Hash: 5A219CA1B0990246EBB59B3DA56817452519F54BE0F1C5730DB3E067D9EF2CF8928708

Function 00007FF8B8B320DC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON312 ref: 00007FF8B8B32132
PyErr_Format.PYTHON312 ref: 00007FF8B8B360C4

Strings

Invalid compression preset: %u, xrefs: 00007FF8B8B360BA
Invalid filter chain for FORMAT_ALONE - must be a single LZMA1 filter, xrefs: 00007FF8B8B36117

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Err_$FormatOccurred
String ID: Invalid compression preset: %u$Invalid filter chain for FORMAT_ALONE - must be a single LZMA1 filter
API String ID: 4038069558-4068623215
Opcode ID: 42de15237a213d44223ebd833c4df5f098df34b0787ac9d39a2d3eb57667bed4
Instruction ID: 418fc56c625e7e527b08a6ea3fbd6d6e18f9eeafae2bcaeb17558fdeb699b784
Opcode Fuzzy Hash: 42de15237a213d44223ebd833c4df5f098df34b0787ac9d39a2d3eb57667bed4
Instruction Fuzzy Hash: 94217F11A9CE4791EE219B3DE94137A2360BF8ABE5F401235DB5E472E6DF2CE5078708

Function 00007FF8B8CE2EFD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE2F04
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE2FDA
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE2FF1
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE3007

Strings

<module>, xrefs: 00007FF8B8CE3018

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 4b12f555bacad9522f59093536ead85a57240267a6d3aa3ff40fce1b0501a7e8
Instruction ID: f1592847a17c4f7ad6699687d5730b18f203e298f2dfef28c3e49d726d8293ff
Opcode Fuzzy Hash: 4b12f555bacad9522f59093536ead85a57240267a6d3aa3ff40fce1b0501a7e8
Instruction Fuzzy Hash: 1631C0B5A08B4782E7A09B5DB86857433A4BB48BC6F444436DA6D47B68DF3CF4538708

Function 00007FF8B8CE326D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE3273
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE3331
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE3348
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE335E

Strings

<module>, xrefs: 00007FF8B8CE336F

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 1860a7d5ba5a0637c41751a3ce46a500ea5aac3d17db15aaa5db88cbc2a32e66
Instruction ID: bdfa7352180488b9b9873f9230e59fce7c25450dfc09496e70b6ec646d2e7d6c
Opcode Fuzzy Hash: 1860a7d5ba5a0637c41751a3ce46a500ea5aac3d17db15aaa5db88cbc2a32e66
Instruction Fuzzy Hash: 5831E6F5E09B4A82E7909B19B86857433A4BF08BD2F404436DA6D47B64EF3CB552C748

Function 00007FF8B8CE2701 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE2707
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE27AD
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE27C4
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE27DA

Strings

<module>, xrefs: 00007FF8B8CE27EB

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 3f2332356931184e6501015defa88c1d245f7b25bfe9b71bbf2c72ea6a00fa8a
Instruction ID: b793b54154ad411e68381524b35da95cacd87e7dafe0ca6975f1b26b1ce2c2e8
Opcode Fuzzy Hash: 3f2332356931184e6501015defa88c1d245f7b25bfe9b71bbf2c72ea6a00fa8a
Instruction Fuzzy Hash: 3E31C2B5A08B4782FBA09F09E8A826423A5BF087C2F440535DA2D07A64DF3CB456C748

Function 00007FF8B8CE2BD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE2BD6
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE2C64
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE2C7B
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE2C91

Strings

<module>, xrefs: 00007FF8B8CE2CA2

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: faebbaeb77ca0f4f516b262e93004c19f89b7d84595a6b1439bf542028db819b
Instruction ID: 4d94f111ff83de5edb6d6f92c6065dd5299d4331b985e83dee05609b0ea73d66
Opcode Fuzzy Hash: faebbaeb77ca0f4f516b262e93004c19f89b7d84595a6b1439bf542028db819b
Instruction Fuzzy Hash: 6E21E4F5E08B4386FB909F09A8B817423A5BF09BD2F441439DA2D07B64EF3CB5568348

Function 00007FF8B8CE2D67 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE2D6D
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE2DFB
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE2E12
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE2E28

Strings

<module>, xrefs: 00007FF8B8CE2E39

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 75194c0cbc9a507f0b92e1b34c94570ff1e2da8f97792c352aaccb42d87fe693
Instruction ID: f7f9cb9d34c95b38cc4db0b0a8e30787e92a91241db2411df824ba6a750aea7a
Opcode Fuzzy Hash: 75194c0cbc9a507f0b92e1b34c94570ff1e2da8f97792c352aaccb42d87fe693
Instruction Fuzzy Hash: D921C6F5E09B5782EBA19F09B86817423A5BF04BC2F444435DA2D07B64DF3CB5568748

Function 00007FF8B8CE30DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE30E3
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE316A
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE3181
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE3197

Strings

<module>, xrefs: 00007FF8B8CE31A8

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: ecdd50443da1972dac5f7d239e36a52e9dfd88a895bebb8cd24304ee5dc28952
Instruction ID: b62df1b10067307eebfee21f04443c810c5bf24e3330c929650fe91214e404d4
Opcode Fuzzy Hash: ecdd50443da1972dac5f7d239e36a52e9dfd88a895bebb8cd24304ee5dc28952
Instruction Fuzzy Hash: 9F21D4F5E08B4282FBA19B19B8AC1B422A5BF04BD2F445439CA2D07B64DF3CB5568348

Function 00007FF8B8CE28B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE28B6
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE293D
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE2954
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE296A

Strings

<module>, xrefs: 00007FF8B8CE297B

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: a16e5229b7237972c2ee806c9dd78c651fb2e9dfacde5010816b5e6c7d31e686
Instruction ID: a094998c1477cfa030a20be3b68b9414a47cef23618e528bb866ea2578722fdc
Opcode Fuzzy Hash: a16e5229b7237972c2ee806c9dd78c651fb2e9dfacde5010816b5e6c7d31e686
Instruction Fuzzy Hash: 8F21F6F5E09B4782FBA49F19B82827423A9BF04BC2F441435DA6D07A64DF3CB516C348

Function 00007FF8B8CE2A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE2A46
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE2ACD
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE2AE4
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE2AFA

Strings

<module>, xrefs: 00007FF8B8CE2B0B

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: e4eff726a2b882ab3716e79be69498aa5b1f0e510f484dcc5ac300c35e7575a4
Instruction ID: f261f3ac455f07cfeb475f1c97a42f3ec4ba745f51c274fa5c630f0bb0a016de
Opcode Fuzzy Hash: e4eff726a2b882ab3716e79be69498aa5b1f0e510f484dcc5ac300c35e7575a4
Instruction Fuzzy Hash: 1221D4F5E09B5782FBA19F1DA86827422A5BF08BD2F444435DA2D07A64DF3CB512C748

Function 00007FF8B8CE3434 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE343A
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE34C1
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE34D8
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE34EE

Strings

<module>, xrefs: 00007FF8B8CE34FF

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: ee343125aa57c54faf244a34e48bc46db9da3b9588f8e1c1ef8b5bbee5cf8946
Instruction ID: a861566108f4c2fe98664e1e51ed8efef312d05c7eb24495d76fc16babd59225
Opcode Fuzzy Hash: ee343125aa57c54faf244a34e48bc46db9da3b9588f8e1c1ef8b5bbee5cf8946
Instruction Fuzzy Hash: 6721E7F5E09B4682FBA19F1DB8681B423A5BF04BD2F484435CA2D07B64DF3CB5568748

Function 00007FF8B8CE2E6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8B8CE2E8C
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE2EAA
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE2EC4

Strings

<module>, xrefs: 00007FF8B8CE3822
>, xrefs: 00007FF8B8CE2ED8

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>$>
API String ID: 4228545439-4024159097
Opcode ID: 4e122b1be13b90b9fde975fa5c7cafe2c707fcb1664262955b8b1ef10f53763c
Instruction ID: 64fbd3dfcb0e2d61d08dab0815796049e30c81a54a27ec73885bd0e199b151bf
Opcode Fuzzy Hash: 4e122b1be13b90b9fde975fa5c7cafe2c707fcb1664262955b8b1ef10f53763c
Instruction Fuzzy Hash: A001E5E6A09A1382FBA55F1CE8682792261AF44BD3F445035DB2E07794DF3DB8838308

Function 00007FF8B93C3A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PyFrozenSet_New.PYTHON312 ref: 00007FF8B93C3A9B
EVP_MD_do_all_provided.LIBCRYPTO-3 ref: 00007FF8B93C3AC1
PyModule_AddObject.PYTHON312 ref: 00007FF8B93C3AE1
_Py_Dealloc.PYTHON312 ref: 00007FF8B93C5538

Strings

openssl_md_meth_names, xrefs: 00007FF8B93C3AD7

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: D_do_all_providedDeallocFrozenModule_ObjectSet_
String ID: openssl_md_meth_names
API String ID: 4100423519-1600430994
Opcode ID: 5b6e10f2f0a00b63709425fc6a0d031263158d93ab584c08f44f7e0f9b367ce1
Instruction ID: 7b874dbe27c7516141baff5dfb00be1fb67acb398a75d2b86e910220fceb80db
Opcode Fuzzy Hash: 5b6e10f2f0a00b63709425fc6a0d031263158d93ab584c08f44f7e0f9b367ce1
Instruction Fuzzy Hash: 91011A35A0DF8282EA244F69A8452BB63B0FF4C7E8F442135DB4E426A0DF7EE15D8740

Function 00007FF8B93C3B00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FF8B93C3B0D
PyErr_NewException.PYTHON312 ref: 00007FF8B93C3B2A
PyModule_AddObjectRef.PYTHON312 ref: 00007FF8B93C3B46

Strings

_hashlib.UnsupportedDigestmodError, xrefs: 00007FF8B93C3B1A
UnsupportedDigestmodError, xrefs: 00007FF8B93C3B3C

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Module_$Err_ExceptionObjectState
String ID: UnsupportedDigestmodError$_hashlib.UnsupportedDigestmodError
API String ID: 2341384915-1819944972
Opcode ID: 8d7e47158559cdaf1961b8e5f2372ac4fa5e889ca1a750e22932b2a78fd80280
Instruction ID: 99b35d3efac605fec9a16e8f4ede2b451d38402f132b0b580cb3832ab1b7fb3d
Opcode Fuzzy Hash: 8d7e47158559cdaf1961b8e5f2372ac4fa5e889ca1a750e22932b2a78fd80280
Instruction Fuzzy Hash: C9F01D61709F8282EA158F2EE44517A23B0EF0CBE4B546235EF1E467A4DF2DE5988740

Function 00007FF8B9061050 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

PyImport_ImportModule.PYTHON312 ref: 00007FF8B906105B
_Py_Dealloc.PYTHON312 ref: 00007FF8B906107B
PyCapsule_Import.PYTHON312 ref: 00007FF8B906108A

Strings

charset_normalizer.md__mypyc.init_charset_normalizer___md, xrefs: 00007FF8B9061083
charset_normalizer.md__mypyc, xrefs: 00007FF8B9061054

Memory Dump Source

Source File: 00000003.00000002.2174014272.00007FF8B9061000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9060000, based on PE: true

Associated: 00000003.00000002.2173996919.00007FF8B9060000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000003.00000002.2174033510.00007FF8B9062000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000003.00000002.2174052648.00007FF8B9064000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b9060000_LKEAHetlG6.jbxd

Similarity

API ID: Import$Capsule_DeallocImport_Module
String ID: charset_normalizer.md__mypyc$charset_normalizer.md__mypyc.init_charset_normalizer___md
API String ID: 1394619730-824592145
Opcode ID: 7acd460ead8a0415d8ca6a34401a615caf6aaf7cbb401ab06b18a46d6c3284b6
Instruction ID: 21b1aeb1ba3e954439f2444968171c7dc3f04a597076cac398ad7b93fed5f145
Opcode Fuzzy Hash: 7acd460ead8a0415d8ca6a34401a615caf6aaf7cbb401ab06b18a46d6c3284b6
Instruction Fuzzy Hash: FAE0E521E0E6C2C5FE99DF2D9C4427432A4AFA8B80F858434C70D862A1EF7CE59B8710

Function 00007FF8B8CD2ED0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD2EFF
PyLong_FromSsize_t.PYTHON312 ref: 00007FF8B8CD2F27
PyObject_RichCompareBool.PYTHON312 ref: 00007FF8B8CD2F3E
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD2F54
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD2F68

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocFromLong_Ssize_t$BoolCompareObject_Rich
String ID:
API String ID: 4107546884-0
Opcode ID: 48720d78ba32745252a3d04257a9edec78878515a75e68daf766dae4164bca8c
Instruction ID: 7c3276ae3d6815b8400f24116d01abc7604a7aa1b339e892320c32cf15f07805
Opcode Fuzzy Hash: 48720d78ba32745252a3d04257a9edec78878515a75e68daf766dae4164bca8c
Instruction Fuzzy Hash: 8D214FB2A0865352E7B45F2D992C3386290AF45BF1F484A30EB39467D8DF2CF8528B04

Function 00007FF8B93C2940 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_PyNumber_Index.PYTHON312 ref: 00007FF8B93C2982
PyLong_AsSsize_t.PYTHON312 ref: 00007FF8B93C2997
_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B93C536B
_Py_Dealloc.PYTHON312 ref: 00007FF8B93C538F
PyErr_Occurred.PYTHON312 ref: 00007FF8B93C539B

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Arg_DeallocErr_IndexKeywordsLong_Number_OccurredSsize_tUnpack
String ID:
API String ID: 2202598743-0
Opcode ID: 502dd0dfe24ab60e842bf1a2f6b32b2ae5cc06be7c8f8d54d9e2ba460c1497fc
Instruction ID: 3b958894cce37894690965d3e2f43475f3c28fd852c57580648c884131f16eb0
Opcode Fuzzy Hash: 502dd0dfe24ab60e842bf1a2f6b32b2ae5cc06be7c8f8d54d9e2ba460c1497fc
Instruction Fuzzy Hash: 47211B31A0DF8281EA548F19A44427A62A1BF4DBE4F586234EF6E067D5EF7CE5198700

Function 00007FF8B93C2770 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_PyNumber_Index.PYTHON312 ref: 00007FF8B93C27B2
PyLong_AsSsize_t.PYTHON312 ref: 00007FF8B93C27C7
_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B93C522B
_Py_Dealloc.PYTHON312 ref: 00007FF8B93C524F
PyErr_Occurred.PYTHON312 ref: 00007FF8B93C525B

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Arg_DeallocErr_IndexKeywordsLong_Number_OccurredSsize_tUnpack
String ID:
API String ID: 2202598743-0
Opcode ID: 116d2d3ca40361578d9d1c7930a1da52d128bd085d65b0db78c617fbe96dbb94
Instruction ID: ad822d26ebf77e53e65819e8991ca9520321205c2c39c1cc6f3dd7dedcdfe780
Opcode Fuzzy Hash: 116d2d3ca40361578d9d1c7930a1da52d128bd085d65b0db78c617fbe96dbb94
Instruction Fuzzy Hash: 01211D31A0DF8282EA509F19A88427A62A0BF4DBE0F485334DF6E067D5DF3CE5098700

Function 00007FF8B8CD8010 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD803C
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD8065
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD808E
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD80B7
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD80D9

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: 02352599f705a3241e88950aa0469c59beaf4792bcb6d3889a9a60b667567bda
Instruction ID: 65cc16cca1d31cd186b0ff73ae71ce279f033208609177d495ffbb0632edccfc
Opcode Fuzzy Hash: 02352599f705a3241e88950aa0469c59beaf4792bcb6d3889a9a60b667567bda
Instruction Fuzzy Hash: 2E31C8B6909A0182E7B56F3CA46C37832A4EB44BB9F145734CB39451D5CF7EB8868B0C

Function 00007FF8B8B3314C Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FF8B8B3315A
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B331CF
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B331D7
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B3629E

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Module_State
String ID:
API String ID: 3434497292-0
Opcode ID: db67306de73857620c4aba995a460db50807d40a919903c7b44c58eb7544d94b
Instruction ID: da2f96a446c7888743511e8c60114bb43b1933f6e8ef4721ac881c668e549b93
Opcode Fuzzy Hash: db67306de73857620c4aba995a460db50807d40a919903c7b44c58eb7544d94b
Instruction Fuzzy Hash: 0F21D777D9EE0685FB6B4F79E85833A22A0AF49B89F184434C70E46190CF7DA4468359

Function 00007FF8B8CD4990 Relevance: 7.5, APIs: 5, Instructions: 29threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON312 ref: 00007FF8B8CD499D
_PyTrash_cond.PYTHON312 ref: 00007FF8B8CD49AF
_PyThreadState_UncheckedGet.PYTHON312 ref: 00007FF8B8CD49B9
_PyTrash_begin.PYTHON312 ref: 00007FF8B8CD49C8
_PyTrash_end.PYTHON312 ref: 00007FF8B8CD49E7

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Object_State_ThreadTrackTrash_beginTrash_condTrash_endUnchecked
String ID:
API String ID: 3074927763-0
Opcode ID: 827b1114b3bde6b7782323d29114232b68231d63ae6a03841d0d76945457bef3
Instruction ID: aa78aeb93284fc20430924a92744cffd5bf36ba5c83e6839d15e8b6ab9079e9c
Opcode Fuzzy Hash: 827b1114b3bde6b7782323d29114232b68231d63ae6a03841d0d76945457bef3
Instruction Fuzzy Hash: BFF012A5B0864382EBA55B5BB96C1395265BF48FD6F485034CB2D07618DF2CE456C704

Function 00007FF8B8CD6AB0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD6ADA

Strings

interpreted classes cannot inherit from compiled, xrefs: 00007FF8B8CD6AD0
charset_normalizer.md.SuperWeirdWordPlugin, xrefs: 00007FF8B8CD6BD9
__init__, xrefs: 00007FF8B8CD6B19, 00007FF8B8CD6BEC

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.SuperWeirdWordPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-371468285
Opcode ID: 98918f0986896f26525c7bd9e5b43f4031bd6749c4d76523467727f76d4c2467
Instruction ID: a6eea38f8bd39376cdf716c4b80a555e8e347c2423c228a87e81b14347eeca4f
Opcode Fuzzy Hash: 98918f0986896f26525c7bd9e5b43f4031bd6749c4d76523467727f76d4c2467
Instruction Fuzzy Hash: 6C4129B2A08B4182E7A4CF29E85836973A0FB48BC8F544135CB5C47768EF7DE496C748

Function 00007FF8B8CD7E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD7E3A

Strings

interpreted classes cannot inherit from compiled, xrefs: 00007FF8B8CD7E30
charset_normalizer.md.ArchaicUpperLowerPlugin, xrefs: 00007FF8B8CD7F27
__init__, xrefs: 00007FF8B8CD7E75, 00007FF8B8CD7F3A

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.ArchaicUpperLowerPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-353558827
Opcode ID: d9e477cc0f5dbe889ee029430d6b8f0b420a3cfa5d140793ed0a56d7501aa99d
Instruction ID: e5f002b492f12761b54be50394da1e54128bc0ced73fde69a7e47471f422ae00
Opcode Fuzzy Hash: d9e477cc0f5dbe889ee029430d6b8f0b420a3cfa5d140793ed0a56d7501aa99d
Instruction Fuzzy Hash: 25313DB2608B4186E7A08F2DE86836973A4FB48BC8F540435DB5C47759EF7DE852C748

Function 00007FF8B8CD4AB0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD4ADA

Strings

charset_normalizer.md.TooManySymbolOrPunctuationPlugin, xrefs: 00007FF8B8CD4BAF
interpreted classes cannot inherit from compiled, xrefs: 00007FF8B8CD4AD0
__init__, xrefs: 00007FF8B8CD4B19, 00007FF8B8CD4BC2

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.TooManySymbolOrPunctuationPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-3280324660
Opcode ID: a1ddc10de017addce63480acb8cb0cb49846706b3ca5f678430c59beec134696
Instruction ID: d85e50e230260203bf6698b45129eb57ed3896cc880832193e232cbc30e551c4
Opcode Fuzzy Hash: a1ddc10de017addce63480acb8cb0cb49846706b3ca5f678430c59beec134696
Instruction Fuzzy Hash: FB314BB1A09A4286E7A08F2DE86836573A4FB48BC8F540435CB5C47758DF3DE852C748

Function 00007FF8B8CD6560 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD658A

Strings

charset_normalizer.md.SuspiciousRange, xrefs: 00007FF8B8CD664B
interpreted classes cannot inherit from compiled, xrefs: 00007FF8B8CD6580
__init__, xrefs: 00007FF8B8CD65C9, 00007FF8B8CD665E

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.SuspiciousRange$interpreted classes cannot inherit from compiled
API String ID: 1450464846-880397153
Opcode ID: 49407b564c236b4001e082ae6d16e11313c9b7c79a02ae8e4e4803c904df55db
Instruction ID: 4b57ffcc003531e8fb833e916f32aa28da01a8e6c85b77fc25e08c7f3c5bdaa9
Opcode Fuzzy Hash: 49407b564c236b4001e082ae6d16e11313c9b7c79a02ae8e4e4803c904df55db
Instruction Fuzzy Hash: 1C3152B1A08A4186EBA0DF1DE46826573A0FF48BC4F544435CB5C47758DF3DE552C748

Function 00007FF8B8CD5E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD5E4A

Strings

interpreted classes cannot inherit from compiled, xrefs: 00007FF8B8CD5E40
charset_normalizer.md.SuspiciousDuplicateAccentPlugin, xrefs: 00007FF8B8CD5F0B
__init__, xrefs: 00007FF8B8CD5E89, 00007FF8B8CD5F1E

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.SuspiciousDuplicateAccentPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-1506521901
Opcode ID: c9011ee015d9b478a68b666d2386e0bc45b2be7c5bf24e43dd3277610430b050
Instruction ID: 62ef7a72ab4a677c497c776a5664d69e428e0549ab7cf3ab38b31fb5521e64ec
Opcode Fuzzy Hash: c9011ee015d9b478a68b666d2386e0bc45b2be7c5bf24e43dd3277610430b050
Instruction Fuzzy Hash: 3E3170B1A08A4286E7A0DF1DE86826573A0FF48BC4F940431CB5C47758EF3DE952C708

Function 00007FF8B8CD79F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD7A1A

Strings

interpreted classes cannot inherit from compiled, xrefs: 00007FF8B8CD7A10
charset_normalizer.md.CjkInvalidStopPlugin, xrefs: 00007FF8B8CD7AC7
__init__, xrefs: 00007FF8B8CD7A59, 00007FF8B8CD7ADA

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.CjkInvalidStopPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-2610960353
Opcode ID: 76a7a677629842859978aaa54d4c908ac2703a6c097ce1729baa8608753adc48
Instruction ID: 9697d7a6a8d9bbbea52f2bce1d1153c5c90eee698bd0a6bbe3f1539bf2b91b4d
Opcode Fuzzy Hash: 76a7a677629842859978aaa54d4c908ac2703a6c097ce1729baa8608753adc48
Instruction Fuzzy Hash: 64312FB1A09A4282EBA0DF1DE86826563A0FB48BC8F544432DB6C47758EF3DE552C748

Function 00007FF8B8CD5450 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD547A

Strings

charset_normalizer.md.TooManyAccentuatedPlugin, xrefs: 00007FF8B8CD5527
interpreted classes cannot inherit from compiled, xrefs: 00007FF8B8CD5470
__init__, xrefs: 00007FF8B8CD54B9, 00007FF8B8CD553A

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.TooManyAccentuatedPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-2999409259
Opcode ID: 46a8908cafe4df30933cc1bf2f0944172b9d1b0b9ac90932bbe1890628880787
Instruction ID: e7eb68b5fa5cbe919005c9fea7e3061d07c1470c8fbfc98ff06431419c255a70
Opcode Fuzzy Hash: 46a8908cafe4df30933cc1bf2f0944172b9d1b0b9ac90932bbe1890628880787
Instruction Fuzzy Hash: 183184B1A08A0282EBA0CF1DE82826573A1FF48BC4F540431DB5C47768EF3DE952C748

Function 00007FF8B8CD8A10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD8A3A

Strings

interpreted classes cannot inherit from compiled, xrefs: 00007FF8B8CD8A30
charset_normalizer.md.ArabicIsolatedFormPlugin, xrefs: 00007FF8B8CD8AE7
__init__, xrefs: 00007FF8B8CD8A79, 00007FF8B8CD8AFA

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.ArabicIsolatedFormPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-1141011871
Opcode ID: b59ea239b0ded2da1d7d86f123c67e001364e70b8c495ebd1fe9a254676c74a7
Instruction ID: f4a98439801daf4e2343ac8960be2c13f6d01a466889cc7a6723c734c48749a7
Opcode Fuzzy Hash: b59ea239b0ded2da1d7d86f123c67e001364e70b8c495ebd1fe9a254676c74a7
Instruction Fuzzy Hash: 2E312FB1A09B4682EBA09F2DE86826563A0FF48BC8F544431DF5C47768EF3DE552C748

Function 00007FF8B8CD5A00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD5A2A

Strings

charset_normalizer.md.UnprintablePlugin, xrefs: 00007FF8B8CD5AD7
interpreted classes cannot inherit from compiled, xrefs: 00007FF8B8CD5A20
__init__, xrefs: 00007FF8B8CD5A69, 00007FF8B8CD5AEA

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.UnprintablePlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-116036081
Opcode ID: 571f9f9e96768ffb2ac53c4efc93ddbf52cbfab833ec0306282c52c0bf4d27d3
Instruction ID: ff34f55d84260870a65fc483738a920f0bca6556bf7eaf9384ab875b86c9dc37
Opcode Fuzzy Hash: 571f9f9e96768ffb2ac53c4efc93ddbf52cbfab833ec0306282c52c0bf4d27d3
Instruction Fuzzy Hash: 903123B1A08A5282E7A0DB1DE46827563A0FF48BC8F544431DB5C47B58EF7DE952C748

Function 00007FF8B8CD9150 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FF8B8CD9199

Strings

str, xrefs: 00007FF8B8CD91F3
charset_normalizer.md.MessDetectorPlugin, xrefs: 00007FF8B8CD91A6
eligible, xrefs: 00007FF8B8CD9206

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: SubtypeType_
String ID: charset_normalizer.md.MessDetectorPlugin$eligible$str
API String ID: 2891779845-1291782451
Opcode ID: 7f0862f8ed2a2bf7f8ea4440bfcb9bd23f6d9e60511077b2f04859b75fbf1be2
Instruction ID: a967a249d3a52d20616184ad89c3b342f8f9226278d0752da755d492799503ac
Opcode Fuzzy Hash: 7f0862f8ed2a2bf7f8ea4440bfcb9bd23f6d9e60511077b2f04859b75fbf1be2
Instruction Fuzzy Hash: BB118EE5B0864682EBB0AF5DE8A81B563A0AF45BC1F844032CB1D47794DF2CE857C708

Function 00007FF8B8CD69A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD69C6
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD69EE

Strings

str or None, xrefs: 00007FF8B8CD6A3C
'SuspiciousRange' object attribute '_last_printable_seen' cannot be deleted, xrefs: 00007FF8B8CD69BC

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'SuspiciousRange' object attribute '_last_printable_seen' cannot be deleted$str or None
API String ID: 1259552197-1971554219
Opcode ID: a918d477a285616c2c2e4df8314c3c17314b771cecf0fb593c970a7c657b72bd
Instruction ID: c6db533602c845af1c06b09d40c6ac24b5e3e6a9ec64d53de8c94972d54981eb
Opcode Fuzzy Hash: a918d477a285616c2c2e4df8314c3c17314b771cecf0fb593c970a7c657b72bd
Instruction Fuzzy Hash: AF11B1B2B0860282EFE49B1DE46863923A0FB48BD4F488131DB1D47794DF3CE896CB04

Function 00007FF8B8CD52B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD52D6
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD52FE

Strings

str or None, xrefs: 00007FF8B8CD534C
'TooManySymbolOrPunctuationPlugin' object attribute '_last_printable_char' cannot be deleted, xrefs: 00007FF8B8CD52CC

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_last_printable_char' cannot be deleted$str or None
API String ID: 1259552197-2331204894
Opcode ID: 4a2e56e4c18d021721d1ff58624d4138fa5cae7aafe6a9259ab8a3639d0b6b2d
Instruction ID: fe4be81da4a30f8d6596c8d8f568fcdada7e26430b4259450d8b81534c84988f
Opcode Fuzzy Hash: 4a2e56e4c18d021721d1ff58624d4138fa5cae7aafe6a9259ab8a3639d0b6b2d
Instruction Fuzzy Hash: 7C1184B2B18A0686EFA49F5DE46827823A0FB48BD4F484131DB1D4B754DF3CE856CB04

Function 00007FF8B8CD6450 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD6476
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD649E

Strings

str or None, xrefs: 00007FF8B8CD64EC
'SuspiciousDuplicateAccentPlugin' object attribute '_last_latin_character' cannot be deleted, xrefs: 00007FF8B8CD646C

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'SuspiciousDuplicateAccentPlugin' object attribute '_last_latin_character' cannot be deleted$str or None
API String ID: 1259552197-4111674009
Opcode ID: 45422d08dff3ba37862566774811d1c873494940e91693ae83718888786eb3b7
Instruction ID: 1f65408d6d19a71e5e2b7ec15cb3e81e2e3409eb288c9073e0058cc510bc6306
Opcode Fuzzy Hash: 45422d08dff3ba37862566774811d1c873494940e91693ae83718888786eb3b7
Instruction Fuzzy Hash: DA1187B6B0450586EFA4DB1DE4A86782360EF48BD4F484135DB1D47755DF3CE452CB04

Function 00007FF8B8CD8870 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD8896
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD88BE

Strings

str or None, xrefs: 00007FF8B8CD890C
'ArchaicUpperLowerPlugin' object attribute '_last_alpha_seen' cannot be deleted, xrefs: 00007FF8B8CD888C

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_last_alpha_seen' cannot be deleted$str or None
API String ID: 1259552197-1607602726
Opcode ID: 2eb1423d3a8d026875b47d3e487d8fbdb754b2b35a34fb420c45883b89527626
Instruction ID: 71aa0717c56594cf30dda90e54e43a9356c67ae130c71c519230aa17724c5ba1
Opcode Fuzzy Hash: 2eb1423d3a8d026875b47d3e487d8fbdb754b2b35a34fb420c45883b89527626
Instruction Fuzzy Hash: 731187B2B0464682EFE59F1DE8682782360FB44BD4F488131DB1D47794DF3DE4428B08

Function 00007FF8B8CD9280 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FF8B8CD92C9

Strings

str, xrefs: 00007FF8B8CD9316
charset_normalizer.md.MessDetectorPlugin, xrefs: 00007FF8B8CD92D6
feed, xrefs: 00007FF8B8CD9329

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: SubtypeType_
String ID: charset_normalizer.md.MessDetectorPlugin$feed$str
API String ID: 2891779845-1310269896
Opcode ID: 174ffd5a8d4fbd5a7ace33c46627c3910e0e1c50ab3d8efb39f58c9a0e45e4fb
Instruction ID: 1d56b41712b2d697e7d65d3df7b0df518012a86346c731978c88b43a6250a1b3
Opcode Fuzzy Hash: 174ffd5a8d4fbd5a7ace33c46627c3910e0e1c50ab3d8efb39f58c9a0e45e4fb
Instruction Fuzzy Hash: 211151E5A0860682EBF4AF6DD8691B563A1AF44BC0F844032DF1D477A4DF2CE847CB08

Function 00007FF8B8CD77C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD77E6
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD780E

Strings

'SuperWeirdWordPlugin' object attribute '_buffer' cannot be deleted, xrefs: 00007FF8B8CD77DC
str, xrefs: 00007FF8B8CD7827

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'SuperWeirdWordPlugin' object attribute '_buffer' cannot be deleted$str
API String ID: 1259552197-1393815803
Opcode ID: e3b12353829d0deeeabf54bb8e44c1ef7eec8a574ceacd3afffb07c93fd7f85b
Instruction ID: ad550544cebd3cae76ceddb128f202e84f93af1f7e577bf92e0c99ec84797877
Opcode Fuzzy Hash: e3b12353829d0deeeabf54bb8e44c1ef7eec8a574ceacd3afffb07c93fd7f85b
Instruction Fuzzy Hash: 0E1154B2A08545C6EBA4DF2DE95826873A0EB44BD4F589031DB2D47658DF3CE896CB04

Function 00007FF8B8CDB7F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

PyObject_VectorcallMethod.PYTHON312 ref: 00007FF8B8CDB818
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CDB860

Part of subcall function 00007FF8B8CD3800: PyErr_Format.PYTHON312 ref: 00007FF8B8CD3834

Strings

eligible, xrefs: 00007FF8B8CDB873
bool, xrefs: 00007FF8B8CDB836

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocErr_FormatMethodObject_Vectorcall
String ID: bool$eligible
API String ID: 2503426208-3320767611
Opcode ID: 6ffd60cce85a421e8434590f2d4fc69a980ada6fd10450d1b70e0e88f2682bec
Instruction ID: 6ff8fafd4902c588e604a56720ba0787ac551c964822a258b76f0b01c6f9d612
Opcode Fuzzy Hash: 6ffd60cce85a421e8434590f2d4fc69a980ada6fd10450d1b70e0e88f2682bec
Instruction Fuzzy Hash: AF1133A1E0864381EBF09B19F8696B96391EF447C5F489035DB5D0AA69DF2CE482CB08

Function 00007FF8B8CD9F80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

PyObject_VectorcallMethod.PYTHON312 ref: 00007FF8B8CD9FA8
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD9FF0

Part of subcall function 00007FF8B8CD3800: PyErr_Format.PYTHON312 ref: 00007FF8B8CD3834

Strings

eligible, xrefs: 00007FF8B8CDA003
bool, xrefs: 00007FF8B8CD9FC6

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocErr_FormatMethodObject_Vectorcall
String ID: bool$eligible
API String ID: 2503426208-3320767611
Opcode ID: 45e89110cdaede4183728df16b150787876237ae891cae742361569b5cc7dc65
Instruction ID: ba742911f60a5140f0e4aa23b739ad664ae08650859851a49b267eb03cc6cfcd
Opcode Fuzzy Hash: 45e89110cdaede4183728df16b150787876237ae891cae742361569b5cc7dc65
Instruction Fuzzy Hash: 901133A1E0864282EBF09F1DF8696B533D0EF447C5F585035DB5E0AA69DF2CE486CB08

Function 00007FF8B8CD95B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

PyObject_VectorcallMethod.PYTHON312 ref: 00007FF8B8CD95D8
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD9620

Part of subcall function 00007FF8B8CD3800: PyErr_Format.PYTHON312 ref: 00007FF8B8CD3834

Strings

eligible, xrefs: 00007FF8B8CD9633
bool, xrefs: 00007FF8B8CD95F6

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocErr_FormatMethodObject_Vectorcall
String ID: bool$eligible
API String ID: 2503426208-3320767611
Opcode ID: c5b4b4656a59a8e67beff081790a41d695e4145e237a7eb8b31be5e0c87158af
Instruction ID: e591dac2c4fe0ef3cc15ab3d1ad7a2e154d7e203a9d1220d6e5fb28c49ff5462
Opcode Fuzzy Hash: c5b4b4656a59a8e67beff081790a41d695e4145e237a7eb8b31be5e0c87158af
Instruction Fuzzy Hash: AC1156E5E0864282EBF09F1DF8696B523A0EF447C5F485036DB5D0AA59DF2CE487CB08

Function 00007FF8B8CE31DC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8B8CE31FB
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE3219
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE3233

Strings

<module>, xrefs: 00007FF8B8CE3822

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 70a5f35237a7bac29e318148100934e2ec0d39acdf239b2d5f662bd422f8af1b
Instruction ID: ca3769be18f3311b272fa6d6940d221ca8694bfb14cf6b29cedad91af5efe6ff
Opcode Fuzzy Hash: 70a5f35237a7bac29e318148100934e2ec0d39acdf239b2d5f662bd422f8af1b
Instruction Fuzzy Hash: ED011AE6E09A0292F7955B6CE86C2742261AF10BD2F448035CB2E077A5DF3DF9878708

Function 00007FF8B8CE29AF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8B8CE29CE
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE29EC
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE2A06

Strings

<module>, xrefs: 00007FF8B8CE3822

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 61c017c81d5e6fa3815ca9fce73e5b847532078dee348fb6f530cef8c5aad8c5
Instruction ID: ce2fa4f4962d4226b473e8bd19ce0c41698f6cfe6b971765ac00c8816fed3a5e
Opcode Fuzzy Hash: 61c017c81d5e6fa3815ca9fce73e5b847532078dee348fb6f530cef8c5aad8c5
Instruction Fuzzy Hash: 570108E6E09A4382F7A55F1DE86837822A1AF04BD2F445035DB2D07694DF3DF882D308

Function 00007FF8B8CE33A3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8B8CE33C2
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE33E0
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE33FA

Strings

<module>, xrefs: 00007FF8B8CE3822

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 3307c57545eb4b4e003a50abc7e3a22bbca76da34ce5ed7b4551bd04aed3351c
Instruction ID: 21824a6ecb57648034914ed5fa1c2193e723f4e4bc10401f3d3b5c10f44abace
Opcode Fuzzy Hash: 3307c57545eb4b4e003a50abc7e3a22bbca76da34ce5ed7b4551bd04aed3351c
Instruction Fuzzy Hash: A5011AF6E09A4283F7A55B2DE8686782261AF40BD2F544035CB2D07794DF3DF8438308

Function 00007FF8B8CE2B3F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8B8CE2B5E
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE2B7C
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE2B96

Strings

<module>, xrefs: 00007FF8B8CE3822

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 032ea81c99ec7a83fc9ed446e6799de4a32a2fdf75c6d93fa13489cf3ba9ce95
Instruction ID: dd75de90b701c85ca70ba2c6c0a30dd8e813a9a67c22099003a5b783068f8243
Opcode Fuzzy Hash: 032ea81c99ec7a83fc9ed446e6799de4a32a2fdf75c6d93fa13489cf3ba9ce95
Instruction Fuzzy Hash: 95011AE6A09A4382F7A55F1DE8683742261AF44BE2F444035DB2E077A4DF3DF9838309

Function 00007FF8B8CE2CD6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8B8CE2CF5
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE2D13
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE2D2D

Strings

<module>, xrefs: 00007FF8B8CE3822

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 24728f44ecafede275bfe5869a5481c6ada5958cbf93234a040fc8aef190d785
Instruction ID: a8a2c39905e7c8301af1eedce25d645d69b2741a3e93610ec07d52f9b00cff6d
Opcode Fuzzy Hash: 24728f44ecafede275bfe5869a5481c6ada5958cbf93234a040fc8aef190d785
Instruction Fuzzy Hash: A00108E6A09A4383F7959F1DE86827422A1AF44BD6F544035DB2E076A4DF6DF983C308

Function 00007FF8B8CE2670 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8B8CE268F
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE26AD
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE26C7

Strings

<module>, xrefs: 00007FF8B8CE3822

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 097e68ef3b6926ae97075bdf610a732ab01175073ea4774d168167745da7d900
Instruction ID: 0b0faf65c3a7652e5ec09606b82eb5a9c56a78bb06c20c115208748d2b740468
Opcode Fuzzy Hash: 097e68ef3b6926ae97075bdf610a732ab01175073ea4774d168167745da7d900
Instruction Fuzzy Hash: 260108E6A09A0383F7915F5CE8682782261AF48BD3F445135DB2D077A4DF2DF9828748

Function 00007FF8B8CE281F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8B8CE283E
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE285C
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE2876

Strings

<module>, xrefs: 00007FF8B8CE3822

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 5d81bad33af6d0c6a6d34ccc316adc70e06c6ff90d8471e672fe39720f4c7cf5
Instruction ID: 18d4dd5591fd937b0acd0e0d313b4dacdc7fa679194e92696b1b5d7fadd5f7d6
Opcode Fuzzy Hash: 5d81bad33af6d0c6a6d34ccc316adc70e06c6ff90d8471e672fe39720f4c7cf5
Instruction Fuzzy Hash: 650108E6E09A4783F7A55F1DE8682742361AF08BD6F444035DB2D07AA4DF2DF8828308

Function 00007FF8B8CE35F8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE35FE
PyObject_Vectorcall.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE3623
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE363A

Strings

<module>, xrefs: 00007FF8B8CE364C

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$Object_Vectorcall
String ID: <module>
API String ID: 1057673266-217463007
Opcode ID: d65abae93356dae59a4a840aaf2a40b004717b6640a575e0a43327181c576cc2
Instruction ID: 8eace986fe8f5551e0b8d0501047ba078d0bc287750ba1cbb61ec0d43d09972e
Opcode Fuzzy Hash: d65abae93356dae59a4a840aaf2a40b004717b6640a575e0a43327181c576cc2
Instruction Fuzzy Hash: 63F062B6E0969243E7E15F29A8282B9A255BB40BD2F408031CF5906E54DF2CB5468744

Function 00007FF8B8CD4A30 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON312 ref: 00007FF8B8CD4A44
PyErr_Occurred.PYTHON312 ref: 00007FF8B8CD4A87

Part of subcall function 00007FF8B8CD3520: PyObject_IsInstance.PYTHON312 ref: 00007FF8B8CD3530
Part of subcall function 00007FF8B8CD3520: PyObject_CallNoArgs.PYTHON312 ref: 00007FF8B8CD3542
Part of subcall function 00007FF8B8CD3520: PyErr_SetObject.PYTHON312 ref: 00007FF8B8CD3556
Part of subcall function 00007FF8B8CD3520: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD356A

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD4A68

Strings

ratio, xrefs: 00007FF8B8CD4A75

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Object_$DeallocErr_$ArgsAttrCallInstanceObjectOccurred
String ID: ratio
API String ID: 1598006454-4234197119
Opcode ID: 35d559fc8b1310c0c6a435b23598347e2ea6a62b98f84bba43c18296abc6ca69
Instruction ID: 3c19b8a39f597a333bbf150773815fffde6543ebd959adbb492de3ea8071b1d9
Opcode Fuzzy Hash: 35d559fc8b1310c0c6a435b23598347e2ea6a62b98f84bba43c18296abc6ca69
Instruction Fuzzy Hash: 130112A5E09A0782FBF56B6DA82C13513A0AF44BD6F445031CB1D06654EF3CF583870C

Function 00007FF8B8CD3800 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON312 ref: 00007FF8B8CD3834
PyErr_Format.PYTHON312 ref: 00007FF8B8CD3860

Strings

%s object expected; got %U, xrefs: 00007FF8B8CD382D
%s object expected; and errored formatting real type!, xrefs: 00007FF8B8CD3859

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_Format
String ID: %s object expected; and errored formatting real type!$%s object expected; got %U
API String ID: 376477240-2630277986
Opcode ID: 45f3feeb58d62d7b61bd12d7106d8e4dcb9e7cfdec48858d2051b2ab1d508661
Instruction ID: 0ef0cfa8c8043673b5e92fbdfc2abaff328c965f1dad602ec42762d34eb22b9e
Opcode Fuzzy Hash: 45f3feeb58d62d7b61bd12d7106d8e4dcb9e7cfdec48858d2051b2ab1d508661
Instruction Fuzzy Hash: 61F04FA5E08A4282EBA55F6EF9681782360FF48BC5F449035DB1D07659EF6CE9428B08

Function 00007FF8B93C2AD0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

EVP_MD_CTX_md.LIBCRYPTO-3 ref: 00007FF8B93C2AE1

Part of subcall function 00007FF8B93C2BB0: EVP_MD_get_type.LIBCRYPTO-3(?,?,?,00007FF8B93C2AEF), ref: 00007FF8B93C2BB6
Part of subcall function 00007FF8B93C2BB0: OBJ_nid2ln.LIBCRYPTO-3(?,?,?,00007FF8B93C2AEF), ref: 00007FF8B93C2BE1

PyUnicode_FromFormat.PYTHON312 ref: 00007FF8B93C2B0C
_Py_Dealloc.PYTHON312 ref: 00007FF8B93C2B23

Strings

<%U %s object @ %p>, xrefs: 00007FF8B93C2AFB

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: D_get_typeDeallocFormatFromJ_nid2lnUnicode_X_md
String ID: <%U %s object @ %p>
API String ID: 943899189-1790359138
Opcode ID: 9f7b70b6b8ecfc333987d524ab7914dd87c70ca19ee3da7306d6766e0e11ebb0
Instruction ID: c01ddd0fb271a5f5b1b742d0b43a376127f0c28f6527e7a6cb481bc41923eab0
Opcode Fuzzy Hash: 9f7b70b6b8ecfc333987d524ab7914dd87c70ca19ee3da7306d6766e0e11ebb0
Instruction Fuzzy Hash: 3CF0F921A09FC681EA158F5AE9541BA63B0AF4CFD4F146035DF0E077A5DE3CE4498380

Function 00007FF8B8CE306B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8B8CE306B
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE3089
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8CD8F1A), ref: 00007FF8B8CE30A3

Strings

<module>, xrefs: 00007FF8B8CE3822

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 6d3c8ef61b1ce4c915580a507c35e2098bc8d2d339069acd415264474d36893f
Instruction ID: 9fe5949b4b4bbb06f3079481b0d7935da7904601ca076062643184cc4b557e1c
Opcode Fuzzy Hash: 6d3c8ef61b1ce4c915580a507c35e2098bc8d2d339069acd415264474d36893f
Instruction Fuzzy Hash: BEF017E6E09A1383F7A15F6CF86C2792251AF00BD3F404035CB2D06A95EF6DB9878348

Function 00007FF8B93C616C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

HMAC_CTX_get_md.LIBCRYPTO-3 ref: 00007FF8B93C617D

Part of subcall function 00007FF8B93C2BB0: EVP_MD_get_type.LIBCRYPTO-3(?,?,?,00007FF8B93C2AEF), ref: 00007FF8B93C2BB6
Part of subcall function 00007FF8B93C2BB0: OBJ_nid2ln.LIBCRYPTO-3(?,?,?,00007FF8B93C2AEF), ref: 00007FF8B93C2BE1

PyUnicode_FromFormat.PYTHON312 ref: 00007FF8B93C61A0
_Py_Dealloc.PYTHON312 ref: 00007FF8B93C61B7

Strings

<%U HMAC object @ %p>, xrefs: 00007FF8B93C6196

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: D_get_typeDeallocFormatFromJ_nid2lnUnicode_X_get_md
String ID: <%U HMAC object @ %p>
API String ID: 454943875-749664232
Opcode ID: 0d4bdb5b06a2dbfaae990030b257bae755d07f20d5685c5c31eb3ea24569f58d
Instruction ID: 718b1ff6e9e52da716654daa534a5b56fe85cee97553bb610eb5e58d45f803dd
Opcode Fuzzy Hash: 0d4bdb5b06a2dbfaae990030b257bae755d07f20d5685c5c31eb3ea24569f58d
Instruction Fuzzy Hash: 88F0FE21A19F8381EA155F1AFD5417A62B0AF4CFD5F086434DF1E067A6DE3CE4898740

Function 00007FF8B8B31E7C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON312(?,?,00000006,00007FF8B8B30CFC), ref: 00007FF8B8B31E89
PyErr_Occurred.PYTHON312(?,?,00000006,00007FF8B8B30CFC), ref: 00007FF8B8B31E92
PyErr_SetString.PYTHON312(?,?,00000006,00007FF8B8B30CFC), ref: 00007FF8B8B3607B

Strings

Value too large for uint32_t type, xrefs: 00007FF8B8B36071

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for uint32_t type
API String ID: 944333170-1712686559
Opcode ID: beb8bb3f21a158d48b7ae8f5362e1cc07ff4e792364f621d751ee79adeb98e45
Instruction ID: 6b08d8de7aa6811afa3b03a9efb10db1a8cf88a109479a2f1adc50ea06d7e06b
Opcode Fuzzy Hash: beb8bb3f21a158d48b7ae8f5362e1cc07ff4e792364f621d751ee79adeb98e45
Instruction Fuzzy Hash: EFF05820B5CA0395EF005B39E8841382364EF88BC9F089035EB1E4A321DF7DE4868308

Function 00007FF8B8B364E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FF8B8B364F5
PyErr_Occurred.PYTHON312 ref: 00007FF8B8B364FE
PyErr_SetString.PYTHON312 ref: 00007FF8B8B36526

Strings

Value too large for lzma_mode type, xrefs: 00007FF8B8B3651C

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for lzma_mode type
API String ID: 944333170-1290617251
Opcode ID: c75928b8bcefc147294998117d43192376e487e7008253cef88493b04ebec458
Instruction ID: 71c2e1140c2857e3dd5ecba5e7918ef590248578ec6dbda487d8e19d6c70feef
Opcode Fuzzy Hash: c75928b8bcefc147294998117d43192376e487e7008253cef88493b04ebec458
Instruction Fuzzy Hash: 68F01C25B58A47D2EF504F3AF8841386360AF49BC5F595438DB0E46368DF3CF4969709

Function 00007FF8B8B36490 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FF8B8B3649D
PyErr_Occurred.PYTHON312 ref: 00007FF8B8B364A6
PyErr_SetString.PYTHON312 ref: 00007FF8B8B364CE

Strings

Value too large for lzma_match_finder type, xrefs: 00007FF8B8B364C4

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for lzma_match_finder type
API String ID: 944333170-1161044407
Opcode ID: 9914e4eca75eb01d789d50a663b97705113751f3ba4ec09a09449ef1f848119f
Instruction ID: c72fa3347cd9e65a5ecb644470a1a106ce735651182cde09b555199eeba4c5fa
Opcode Fuzzy Hash: 9914e4eca75eb01d789d50a663b97705113751f3ba4ec09a09449ef1f848119f
Instruction Fuzzy Hash: 64F05221E48A0782EF104F3AF98013963A0AF49BC5F084038CB4E0A361DF3CE89A9308

Function 00007FF8B93C5A48 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

HMAC_CTX_get_md.LIBCRYPTO-3 ref: 00007FF8B93C5A52

Part of subcall function 00007FF8B93C2BB0: EVP_MD_get_type.LIBCRYPTO-3(?,?,?,00007FF8B93C2AEF), ref: 00007FF8B93C2BB6
Part of subcall function 00007FF8B93C2BB0: OBJ_nid2ln.LIBCRYPTO-3(?,?,?,00007FF8B93C2AEF), ref: 00007FF8B93C2BE1

PyUnicode_FromFormat.PYTHON312 ref: 00007FF8B93C5A77
_Py_Dealloc.PYTHON312 ref: 00007FF8B93C5A8E

Strings

hmac-%U, xrefs: 00007FF8B93C5A70

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: D_get_typeDeallocFormatFromJ_nid2lnUnicode_X_get_md
String ID: hmac-%U
API String ID: 454943875-3757664071
Opcode ID: e00e0e3559910fc3aaf9526df755fc01e628217c4aefd3fe0e336973487d7e71
Instruction ID: c2cc2172628907c300a9ce31f029a67796b52896a331a1f6885e5fe4a3bb24c1
Opcode Fuzzy Hash: e00e0e3559910fc3aaf9526df755fc01e628217c4aefd3fe0e336973487d7e71
Instruction Fuzzy Hash: D2F0F825A19F9381EA159F2BE99417A63B0BF5CBD0F482430DE0E0A7A5DF3CE4498741

Function 00007FF8B8B2838C Relevance: 6.1, APIs: 4, Instructions: 102threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312(?,?,?,00000000,?,?,?,00007FF8B8B28041), ref: 00007FF8B8B283C1

Part of subcall function 00007FF8B8B32574: PyBytes_FromStringAndSize.PYTHON312(?,?,?,00007FF8B8B283DB,?,?,?,00000000,?,?,?,00007FF8B8B28041), ref: 00007FF8B8B325AB
Part of subcall function 00007FF8B8B32574: PyList_New.PYTHON312(?,?,?,00007FF8B8B283DB,?,?,?,00000000,?,?,?,00007FF8B8B28041), ref: 00007FF8B8B325BE

PyEval_SaveThread.PYTHON312(?,?,?,00000000,?,?,?,00007FF8B8B28041), ref: 00007FF8B8B283E8
PyEval_RestoreThread.PYTHON312(?,?,?,00000000,?,?,?,00007FF8B8B28041), ref: 00007FF8B8B28401
_Py_Dealloc.PYTHON312(?,?,?,00000000,?,?,?,00007FF8B8B28041), ref: 00007FF8B8B284C1

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: Eval_Thread$Bytes_DeallocFromList_ModuleRestoreSaveSizeStateStringType_
String ID:
API String ID: 2935988267-0
Opcode ID: 00cfe97c0164a270be03c1d104ab45d7f8779960225675756503997d0fd06301
Instruction ID: 397ad97beda9b1553e33850e66a34c27a66a9fd940a9b1fafc95361dd4467261
Opcode Fuzzy Hash: 00cfe97c0164a270be03c1d104ab45d7f8779960225675756503997d0fd06301
Instruction Fuzzy Hash: B4417D26A09A4386EA649F3D98501BE2BA4FF88BC8FA40135EB1D47754DF3CE5878305

Function 00007FF8B8CD2E10 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

PyObject_RichCompareBool.PYTHON312 ref: 00007FF8B8CD2E78
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD2E8E
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD2EA2

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc$BoolCompareObject_Rich
String ID:
API String ID: 74976934-0
Opcode ID: 06e8f97dbb0ea0e89ed53f8803494b3fcf86a5d1c840b79286c23275ed2a61a7
Instruction ID: 9090afd753bd322a56744d348ca2f62a91ba7f1cfb87ffcc0a3bb4bbfe108f83
Opcode Fuzzy Hash: 06e8f97dbb0ea0e89ed53f8803494b3fcf86a5d1c840b79286c23275ed2a61a7
Instruction Fuzzy Hash: C9113E72A1854396E7B49F2DE5682782290AB55BF2F081330DB7D47AE5DF2CE8528B04

Function 00007FF8B8CD4C90 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD4CBC
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD4CE5
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD4D0E
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD4D30

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: ece71df874b8b5f5a56a715ca088fb7d08a9acaf02b1d109a510bd9dd73bf957
Instruction ID: 4c88905c8f917b81f949fbbf369a118dd0d8a3908ff4a6028dd5b51ba1da661d
Opcode Fuzzy Hash: ece71df874b8b5f5a56a715ca088fb7d08a9acaf02b1d109a510bd9dd73bf957
Instruction Fuzzy Hash: E421A5B690960281EBB59F3CD46C37822A0AB55BB9F280371CB69451D4CF7DE4878B58

Function 00007FF8B8B276FC Relevance: 6.0, APIs: 4, Instructions: 40threadCOMMON

Download Yara Rule

APIs

PyThread_free_lock.PYTHON312 ref: 00007FF8B8B27749
PyMem_Free.PYTHON312 ref: 00007FF8B8B27776
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B2777E

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocFreeMem_Thread_free_lock
String ID:
API String ID: 2783890233-0
Opcode ID: 01b42428c534275dc39dda495b1f2b4eedd2e9a3cd2baa85ec5288ad07ab9b92
Instruction ID: 75b162915892c5a7bda850466f787fab9ba7c835788c67b341250aaa4a84adc2
Opcode Fuzzy Hash: 01b42428c534275dc39dda495b1f2b4eedd2e9a3cd2baa85ec5288ad07ab9b92
Instruction Fuzzy Hash: C6111B22A1A942C2EA5D8F7AD95437C2B60EF49BC5F984030D71E466A4CF7CE4968B0D

Function 00007FF8B93C60E0 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

HMAC_CTX_new.LIBCRYPTO-3(?,?,?,00007FF8B93C5638), ref: 00007FF8B93C60FA
PyErr_NoMemory.PYTHON312(?,?,?,00007FF8B93C5638), ref: 00007FF8B93C6108

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_MemoryX_new
String ID:
API String ID: 1734961617-0
Opcode ID: bc0be310341f2cc91c4f87042e5777b741434a5cae9f5a5b42afe3591205feca
Instruction ID: fa165d20c430b563b99d4dbebc9eba07f06f277126b3702dadc34cb273a9c7f3
Opcode Fuzzy Hash: bc0be310341f2cc91c4f87042e5777b741434a5cae9f5a5b42afe3591205feca
Instruction Fuzzy Hash: F8015E21B0CF8382EB149F6AA95413B66B0AF8CBC5F546431DF0F47B65DE2CE4894300

Function 00007FF8B90615AC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8B90615D8
GetCurrentThreadId.KERNEL32 ref: 00007FF8B90615E6
GetCurrentProcessId.KERNEL32 ref: 00007FF8B90615F2
QueryPerformanceCounter.KERNEL32 ref: 00007FF8B9061602

Memory Dump Source

Source File: 00000003.00000002.2174014272.00007FF8B9061000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9060000, based on PE: true

Associated: 00000003.00000002.2173996919.00007FF8B9060000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000003.00000002.2174033510.00007FF8B9062000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000003.00000002.2174052648.00007FF8B9064000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b9060000_LKEAHetlG6.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 2a86bf217ae56f2ffddaf1c96c400288edddcb6bf3c22b338817706e1bdff8c8
Instruction ID: 346e4a0cd3c848d93c11e12347485bb01e494f2f3caf158fb72ebdf4a8d5f38d
Opcode Fuzzy Hash: 2a86bf217ae56f2ffddaf1c96c400288edddcb6bf3c22b338817706e1bdff8c8
Instruction Fuzzy Hash: 21111C26B14B428AFF00CF68E8542A833A4F719798F440D31DB6D867A4DF78D199C340

Function 00007FF8B8B33A1C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8B8B33A48
GetCurrentThreadId.KERNEL32 ref: 00007FF8B8B33A56
GetCurrentProcessId.KERNEL32 ref: 00007FF8B8B33A62
QueryPerformanceCounter.KERNEL32 ref: 00007FF8B8B33A72

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: e14f81335c7f0e89c555c48fc70369245093cfa0888173eb1084b591f0c493ce
Instruction ID: 40921fa9c6aeaaa3ee52dd29684ea6c72fc1975df2cb27aad801d48b478c6498
Opcode Fuzzy Hash: e14f81335c7f0e89c555c48fc70369245093cfa0888173eb1084b591f0c493ce
Instruction Fuzzy Hash: 1F111526B55B028AEB008B74E8652A833A4FB19798F440E31EB6D867A4DF7CD1698344

Function 00007FF8B8CE3E9C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8B8CE3EC8
GetCurrentThreadId.KERNEL32 ref: 00007FF8B8CE3ED6
GetCurrentProcessId.KERNEL32 ref: 00007FF8B8CE3EE2
QueryPerformanceCounter.KERNEL32 ref: 00007FF8B8CE3EF2

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d9e6e1a99beb20024c39237dbb01f35985b29cf17aeeaa0b650d61652553da3b
Instruction ID: ef4cbeff94033d69da698687c35a018b42fa373bc0d4cd341ac7b6b14ed00570
Opcode Fuzzy Hash: d9e6e1a99beb20024c39237dbb01f35985b29cf17aeeaa0b650d61652553da3b
Instruction Fuzzy Hash: 4F112162B14F058AEB40CF64F8682B833A4FB19799F440D31EB7D56758DF78E5598340

Function 00007FF8B93C41DC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8B93C4208
GetCurrentThreadId.KERNEL32 ref: 00007FF8B93C4216
GetCurrentProcessId.KERNEL32 ref: 00007FF8B93C4222
QueryPerformanceCounter.KERNEL32 ref: 00007FF8B93C4232

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 48af5b1f208ef3dd29de704b93ff7afa1499a3d8b012d9300ed07526818f66e3
Instruction ID: 0433988f2c630272a25fad6c0a72f6b70125ac0d8ddd11f0a4f998df9ef84925
Opcode Fuzzy Hash: 48af5b1f208ef3dd29de704b93ff7afa1499a3d8b012d9300ed07526818f66e3
Instruction Fuzzy Hash: 14110622B14F518AEB008F64E8552AA33B4FB19798F442E31DF6D467A4DF78D1998340

Function 00007FF8B93C555C Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

HMAC_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C5569

Part of subcall function 00007FF8B93C6388: PyThread_acquire_lock.PYTHON312(?,?,?,00007FF8B93C5582), ref: 00007FF8B93C63A8
Part of subcall function 00007FF8B93C6388: PyEval_SaveThread.PYTHON312(?,?,?,00007FF8B93C5582), ref: 00007FF8B93C63B2
Part of subcall function 00007FF8B93C6388: PyThread_acquire_lock.PYTHON312(?,?,?,00007FF8B93C5582), ref: 00007FF8B93C63C4
Part of subcall function 00007FF8B93C6388: PyEval_RestoreThread.PYTHON312(?,?,?,00007FF8B93C5582), ref: 00007FF8B93C63CD
Part of subcall function 00007FF8B93C6388: HMAC_CTX_copy.LIBCRYPTO-3(?,?,?,00007FF8B93C5582), ref: 00007FF8B93C63DA
Part of subcall function 00007FF8B93C6388: PyThread_release_lock.PYTHON312(?,?,?,00007FF8B93C5582), ref: 00007FF8B93C63EB

HMAC_CTX_free.LIBCRYPTO-3 ref: 00007FF8B93C5589
_PyObject_New.PYTHON312 ref: 00007FF8B93C55A6
HMAC_CTX_free.LIBCRYPTO-3 ref: 00007FF8B93C55B4

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lockX_free$Object_RestoreSaveThread_release_lockX_copyX_new
String ID:
API String ID: 601750000-0
Opcode ID: 403a1a882f2db2db793400a6c0c19345f04cb7f76d7ef0d4665bd7080fa2d807
Instruction ID: 1a6cf69121a967451a871e594db9ec16b71fb30542cc13014f612cdc1400cf2a
Opcode Fuzzy Hash: 403a1a882f2db2db793400a6c0c19345f04cb7f76d7ef0d4665bd7080fa2d807
Instruction Fuzzy Hash: 0201B622A09F8281EA549F2AE95423A67B1AF8CBC4F196435DF0F46365DE3CE4588340

Function 00007FF8B8CD3520 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

PyObject_IsInstance.PYTHON312 ref: 00007FF8B8CD3530
PyObject_CallNoArgs.PYTHON312 ref: 00007FF8B8CD3542
PyErr_SetObject.PYTHON312 ref: 00007FF8B8CD3556
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD356A

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Object_$ArgsCallDeallocErr_InstanceObject
String ID:
API String ID: 469999563-0
Opcode ID: 735d7802508a943567c1b886ab3bcdb7dadecb2b687cb30f547209437c5526d2
Instruction ID: 70e7140eb84dee32d33fd6661c5cc1a823e304fc5e330b097acd497f472ae14c
Opcode Fuzzy Hash: 735d7802508a943567c1b886ab3bcdb7dadecb2b687cb30f547209437c5526d2
Instruction Fuzzy Hash: 62F0F4A5E08B0282EBE59B2AE96C1396391AF44FD1F045030DF5D07B58EF3CE8928708

Function 00007FF8B93C2500 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

EVP_MD_CTX_md.LIBCRYPTO-3 ref: 00007FF8B93C250A
EVP_MD_get_type.LIBCRYPTO-3 ref: 00007FF8B93C2513
OBJ_nid2ln.LIBCRYPTO-3 ref: 00007FF8B93C510E
OBJ_nid2sn.LIBCRYPTO-3 ref: 00007FF8B93C511F

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: D_get_typeJ_nid2lnJ_nid2snX_md
String ID:
API String ID: 3802060142-0
Opcode ID: fcde53bcfe4d740a413b91a67844ea3794e11d57f1df889538aad470677469fd
Instruction ID: af00b7c249fb0838dd304535f7bf4d303ffabfd554b2abf4b6a083fcbb37cf42
Opcode Fuzzy Hash: fcde53bcfe4d740a413b91a67844ea3794e11d57f1df889538aad470677469fd
Instruction Fuzzy Hash: 1E016622A1AF8685EE645F5D98A433A62B0AF5DB85F142439CB0F462A0DE3DA84D8740

Function 00007FF8B93C2900 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

_PyObject_New.PYTHON312(?,?,?,00007FF8B93C28C6), ref: 00007FF8B93C2906
EVP_MD_CTX_new.LIBCRYPTO-3(?,?,?,00007FF8B93C28C6), ref: 00007FF8B93C291C
_Py_Dealloc.PYTHON312(?,?,?,00007FF8B93C28C6), ref: 00007FF8B93C5322
PyErr_NoMemory.PYTHON312(?,?,?,00007FF8B93C28C6), ref: 00007FF8B93C5328

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocErr_MemoryObject_X_new
String ID:
API String ID: 30467670-0
Opcode ID: 068e0d81292d20aa5faf8b669e22c171799e7227662d6f85183d312eb304df4a
Instruction ID: 916ffdf5a98ef0620f7224f1644c4066a718c3944a2ba9e2514a372f18578229
Opcode Fuzzy Hash: 068e0d81292d20aa5faf8b669e22c171799e7227662d6f85183d312eb304df4a
Instruction Fuzzy Hash: 83F0D42190EF8281EB255F29984473A22B1AF1DB95F482430CE4E053A1DE7CE498C311

Function 00007FF8B93C2480 Relevance: 6.0, APIs: 4, Instructions: 26threadCOMMON

Download Yara Rule

APIs

EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF8B93C249E
PyObject_Free.PYTHON312 ref: 00007FF8B93C24A7
PyThread_free_lock.PYTHON312 ref: 00007FF8B93C24C7

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: FreeObject_Thread_free_lockX_free
String ID:
API String ID: 3834077558-0
Opcode ID: b054d7a725bb9655dafd1a88f5124a817cdbe2059b1b581b22101e8fa8edda2c
Instruction ID: 729855b03ffe924b7342eec8a431693462d93f2444da701bb910799c20ba3415
Opcode Fuzzy Hash: b054d7a725bb9655dafd1a88f5124a817cdbe2059b1b581b22101e8fa8edda2c
Instruction Fuzzy Hash: 2BF0D021A0CF8296EA195F2EE99423A2370EB4DFD5F146030DF0F42665CF3CE4998340

Function 00007FF8B8CD4050 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

PyUnicode_New.PYTHON312 ref: 00007FF8B8CD4079
PyObject_Str.PYTHON312 ref: 00007FF8B8CD41BA

Strings

gfffffff, xrefs: 00007FF8B8CD40F4

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Object_Unicode_
String ID: gfffffff
API String ID: 3285369508-1523873471
Opcode ID: 01e85d9c1bd3d17e433c8fb88ec89fd76347e07627257ce4696b6525bbbdcfea
Instruction ID: 3614f5b34733948afd0523392caeea3a635b8cc7bc14e5d15b43ef4426b2b42c
Opcode Fuzzy Hash: 01e85d9c1bd3d17e433c8fb88ec89fd76347e07627257ce4696b6525bbbdcfea
Instruction Fuzzy Hash: FF4117E2B0878583EB609B1AF4253A96B90EB61BD0F442131DB5E47795DF3CF542CB41

Function 00007FF8B93C3150 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON312 ref: 00007FF8B93C31CB

Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C15E3
Part of subcall function 00007FF8B93C1580: _Py_hashtable_get.PYTHON312 ref: 00007FF8B93C15F3
Part of subcall function 00007FF8B93C1580: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF8B93C161D
Part of subcall function 00007FF8B93C1580: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF8B93C1629
Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C163A
Part of subcall function 00007FF8B93C1580: _PyObject_New.PYTHON312 ref: 00007FF8B93C1643
Part of subcall function 00007FF8B93C1580: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C1655
Part of subcall function 00007FF8B93C1580: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF8B93C1671
Part of subcall function 00007FF8B93C1580: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B93C16B9

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B93C321B

Strings

sha3_512, xrefs: 00007FF8B93C318E

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha3_512
API String ID: 668498394-1707686796
Opcode ID: 394ea8788f6f85e1edd4456430980528131de45713a38101526d183dac21f1a9
Instruction ID: 2223378437b75bb86324be7c1867debc7f92192eb6fdf5f49b83a3acd2d557e1
Opcode Fuzzy Hash: 394ea8788f6f85e1edd4456430980528131de45713a38101526d183dac21f1a9
Instruction Fuzzy Hash: 4F21BB32B0DF818AEA609F1AE8042AA62B4FB4CBC4F195131DF4E43758DF7DE9498740

Function 00007FF8B93C3070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON312 ref: 00007FF8B93C30EB

Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C15E3
Part of subcall function 00007FF8B93C1580: _Py_hashtable_get.PYTHON312 ref: 00007FF8B93C15F3
Part of subcall function 00007FF8B93C1580: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF8B93C161D
Part of subcall function 00007FF8B93C1580: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF8B93C1629
Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C163A
Part of subcall function 00007FF8B93C1580: _PyObject_New.PYTHON312 ref: 00007FF8B93C1643
Part of subcall function 00007FF8B93C1580: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C1655
Part of subcall function 00007FF8B93C1580: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF8B93C1671
Part of subcall function 00007FF8B93C1580: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B93C16B9

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B93C313B

Strings

sha224, xrefs: 00007FF8B93C30AE

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha224
API String ID: 668498394-4253541148
Opcode ID: ae775b62807cd303b11be3d9a967453d4376948783c3efc71a448c11541c685f
Instruction ID: 3e64340f5282706e61a2ad472cb4a0208f22e8e330713837da8f8bbfd15ef9ce
Opcode Fuzzy Hash: ae775b62807cd303b11be3d9a967453d4376948783c3efc71a448c11541c685f
Instruction Fuzzy Hash: B4216A32A0DF9186EA608F1AA8446AAA2B4FB8CBC4F095131DF4E43758DF7DD5498B00

Function 00007FF8B93C2C10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON312 ref: 00007FF8B93C2C8B

Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C15E3
Part of subcall function 00007FF8B93C1580: _Py_hashtable_get.PYTHON312 ref: 00007FF8B93C15F3
Part of subcall function 00007FF8B93C1580: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF8B93C161D
Part of subcall function 00007FF8B93C1580: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF8B93C1629
Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C163A
Part of subcall function 00007FF8B93C1580: _PyObject_New.PYTHON312 ref: 00007FF8B93C1643
Part of subcall function 00007FF8B93C1580: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C1655
Part of subcall function 00007FF8B93C1580: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF8B93C1671
Part of subcall function 00007FF8B93C1580: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B93C16B9

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B93C2CDB

Strings

sha256, xrefs: 00007FF8B93C2C4E

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha256
API String ID: 668498394-1556616439
Opcode ID: 73fd627af69da370b307076915e9fb8e18a19cf420d9714ac5034c5486291719
Instruction ID: fc8f8fb193a146c4b70f72a13a22aebaceae58a0b751e27dffb3a8f8844234b5
Opcode Fuzzy Hash: 73fd627af69da370b307076915e9fb8e18a19cf420d9714ac5034c5486291719
Instruction Fuzzy Hash: D5219D76A08F8186EA608F0AE48066A63A4FF58BC4F189130EF4E43754DF7CD5488700

Function 00007FF8B93C3310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON312 ref: 00007FF8B93C338B

Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C15E3
Part of subcall function 00007FF8B93C1580: _Py_hashtable_get.PYTHON312 ref: 00007FF8B93C15F3
Part of subcall function 00007FF8B93C1580: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF8B93C161D
Part of subcall function 00007FF8B93C1580: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF8B93C1629
Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C163A
Part of subcall function 00007FF8B93C1580: _PyObject_New.PYTHON312 ref: 00007FF8B93C1643
Part of subcall function 00007FF8B93C1580: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C1655
Part of subcall function 00007FF8B93C1580: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF8B93C1671
Part of subcall function 00007FF8B93C1580: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B93C16B9

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B93C33DB

Strings

sha3_256, xrefs: 00007FF8B93C334E

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha3_256
API String ID: 668498394-59190292
Opcode ID: c8177f4cfc81247b32388ba64899f21b89cef79004ceb599a0cf96bad0e88251
Instruction ID: 5b8fc8ef381965863d574a33950e8caadf062109d42728a4b7918e799151d77b
Opcode Fuzzy Hash: c8177f4cfc81247b32388ba64899f21b89cef79004ceb599a0cf96bad0e88251
Instruction Fuzzy Hash: 6921A932A0CF8286EA608F5AE4042AA62B4FB4CBC4F185130EF4E43754DF3DE9498700

Function 00007FF8B93C3230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON312 ref: 00007FF8B93C32AB

Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C15E3
Part of subcall function 00007FF8B93C1580: _Py_hashtable_get.PYTHON312 ref: 00007FF8B93C15F3
Part of subcall function 00007FF8B93C1580: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF8B93C161D
Part of subcall function 00007FF8B93C1580: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF8B93C1629
Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C163A
Part of subcall function 00007FF8B93C1580: _PyObject_New.PYTHON312 ref: 00007FF8B93C1643
Part of subcall function 00007FF8B93C1580: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C1655
Part of subcall function 00007FF8B93C1580: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF8B93C1671
Part of subcall function 00007FF8B93C1580: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B93C16B9

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B93C32FB

Strings

sha3_384, xrefs: 00007FF8B93C326E

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha3_384
API String ID: 668498394-1508202818
Opcode ID: 027ef7a297f99fb45c87206d088d9c4369d164f3ded2941d8c0b4108ab76135d
Instruction ID: f5b8893a70e8d54e7492fb7c1f858209cb55c01fdccc2b3adcc760c76abb6d78
Opcode Fuzzy Hash: 027ef7a297f99fb45c87206d088d9c4369d164f3ded2941d8c0b4108ab76135d
Instruction Fuzzy Hash: 92217522A0DF8182EE608F5AE4046AAA2B4FB48BC4F185130DE4E43B44EF3DE9498740

Function 00007FF8B93C2DD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON312 ref: 00007FF8B93C2E4B

Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C15E3
Part of subcall function 00007FF8B93C1580: _Py_hashtable_get.PYTHON312 ref: 00007FF8B93C15F3
Part of subcall function 00007FF8B93C1580: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF8B93C161D
Part of subcall function 00007FF8B93C1580: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF8B93C1629
Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C163A
Part of subcall function 00007FF8B93C1580: _PyObject_New.PYTHON312 ref: 00007FF8B93C1643
Part of subcall function 00007FF8B93C1580: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C1655
Part of subcall function 00007FF8B93C1580: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF8B93C1671
Part of subcall function 00007FF8B93C1580: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B93C16B9

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B93C2E9B

Strings

sha1, xrefs: 00007FF8B93C2E0E

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha1
API String ID: 668498394-858918954
Opcode ID: 407b9ba08e0551f60fc7207ed369db5e68ada242d4117b9baa024dee99a9520a
Instruction ID: 1b609169253b44d2e0e20b40bde3bb8854cbb9089ccb2c5163a6a1781bff758c
Opcode Fuzzy Hash: 407b9ba08e0551f60fc7207ed369db5e68ada242d4117b9baa024dee99a9520a
Instruction Fuzzy Hash: C2218E72A08F8186EA619F2AE48466A62B4FF4CBC4F485130DF4E53754DF7DE9498B40

Function 00007FF8B93C34D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON312 ref: 00007FF8B93C354B

Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C15E3
Part of subcall function 00007FF8B93C1580: _Py_hashtable_get.PYTHON312 ref: 00007FF8B93C15F3
Part of subcall function 00007FF8B93C1580: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF8B93C161D
Part of subcall function 00007FF8B93C1580: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF8B93C1629
Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C163A
Part of subcall function 00007FF8B93C1580: _PyObject_New.PYTHON312 ref: 00007FF8B93C1643
Part of subcall function 00007FF8B93C1580: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C1655
Part of subcall function 00007FF8B93C1580: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF8B93C1671
Part of subcall function 00007FF8B93C1580: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B93C16B9

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B93C359B

Strings

shake_256, xrefs: 00007FF8B93C350E

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: shake_256
API String ID: 668498394-3942869344
Opcode ID: 85f432f44a17908e46debf10400737810314f4c286a22ee97b763c31f9ea1044
Instruction ID: e1612c2542fa1f06b28d3bd69a587d0d76ef57f9c1f1624b15b3d891497faddd
Opcode Fuzzy Hash: 85f432f44a17908e46debf10400737810314f4c286a22ee97b763c31f9ea1044
Instruction Fuzzy Hash: F0216A72A0DF8186EA608F0AA4446AAA2B4FF4CBD4F485130DF4D43755EF7DF5498B00

Function 00007FF8B93C2CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON312 ref: 00007FF8B93C2D6B

Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C15E3
Part of subcall function 00007FF8B93C1580: _Py_hashtable_get.PYTHON312 ref: 00007FF8B93C15F3
Part of subcall function 00007FF8B93C1580: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF8B93C161D
Part of subcall function 00007FF8B93C1580: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF8B93C1629
Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C163A
Part of subcall function 00007FF8B93C1580: _PyObject_New.PYTHON312 ref: 00007FF8B93C1643
Part of subcall function 00007FF8B93C1580: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C1655
Part of subcall function 00007FF8B93C1580: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF8B93C1671
Part of subcall function 00007FF8B93C1580: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B93C16B9

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B93C2DBB

Strings

md5, xrefs: 00007FF8B93C2D2E

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: md5
API String ID: 668498394-3899452385
Opcode ID: e782951d9e9b35ab375197e16246b4e49a92349daeba742cdce1d6475812e42f
Instruction ID: e5bc701ddccacc1c4f7dee6257c3f161aa6b6d6e7c398e5e656743b164f82668
Opcode Fuzzy Hash: e782951d9e9b35ab375197e16246b4e49a92349daeba742cdce1d6475812e42f
Instruction Fuzzy Hash: AD21B032A08F8285EA608F09E48866A63B4FB5CBC4F185130DF5D43754DF7CE9498740

Function 00007FF8B93C33F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON312 ref: 00007FF8B93C346B

Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C15E3
Part of subcall function 00007FF8B93C1580: _Py_hashtable_get.PYTHON312 ref: 00007FF8B93C15F3
Part of subcall function 00007FF8B93C1580: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF8B93C161D
Part of subcall function 00007FF8B93C1580: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF8B93C1629
Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C163A
Part of subcall function 00007FF8B93C1580: _PyObject_New.PYTHON312 ref: 00007FF8B93C1643
Part of subcall function 00007FF8B93C1580: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C1655
Part of subcall function 00007FF8B93C1580: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF8B93C1671
Part of subcall function 00007FF8B93C1580: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B93C16B9

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B93C34BB

Strings

sha3_224, xrefs: 00007FF8B93C342E

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha3_224
API String ID: 668498394-2731072511
Opcode ID: 99c0650f17b5290c5cf9524ea2804535ed0eaa37611b08661316127357b880a7
Instruction ID: 2f24b439274e81ed0a9377defd6068aef93c5e60e5c763c639fe4a20a11879a0
Opcode Fuzzy Hash: 99c0650f17b5290c5cf9524ea2804535ed0eaa37611b08661316127357b880a7
Instruction Fuzzy Hash: 9A219A32A0CF8296EE618F5AA4002AB62B4FB4CBC4F186130DF4E43755DF7DE9498700

Function 00007FF8B93C2F90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON312 ref: 00007FF8B93C300B

Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C15E3
Part of subcall function 00007FF8B93C1580: _Py_hashtable_get.PYTHON312 ref: 00007FF8B93C15F3
Part of subcall function 00007FF8B93C1580: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF8B93C161D
Part of subcall function 00007FF8B93C1580: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF8B93C1629
Part of subcall function 00007FF8B93C1580: PyModule_GetState.PYTHON312 ref: 00007FF8B93C163A
Part of subcall function 00007FF8B93C1580: _PyObject_New.PYTHON312 ref: 00007FF8B93C1643
Part of subcall function 00007FF8B93C1580: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8B93C1655
Part of subcall function 00007FF8B93C1580: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF8B93C1671
Part of subcall function 00007FF8B93C1580: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8B93C16B9

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B93C305B

Strings

sha384, xrefs: 00007FF8B93C2FCE

Memory Dump Source

Source File: 00000003.00000002.2174090897.00007FF8B93C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000003.00000002.2174071947.00007FF8B93C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174108766.00007FF8B93C7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174125883.00007FF8B93CC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.2174143822.00007FF8B93CE000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b93c0000_LKEAHetlG6.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha384
API String ID: 668498394-111829409
Opcode ID: af0e07dae9fd186dd62fd38fdb349da9e93ef4becf4423fd866f1e0706baa2f7
Instruction ID: 216cb1c78a8813d307f5a724fe60c305f13dabd3f3abb67d37d9711abcfe5bac
Opcode Fuzzy Hash: af0e07dae9fd186dd62fd38fdb349da9e93ef4becf4423fd866f1e0706baa2f7
Instruction Fuzzy Hash: 71217F72608F9286EA608F0AE44466B62B4FB4CBC4F085130EF4E43759DF7DE5498700

Function 00007FF8B8CD93B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FF8B8CD93EB

Part of subcall function 00007FF8B8CD3800: PyErr_Format.PYTHON312 ref: 00007FF8B8CD3834

Part of subcall function 00007FF8B8CD3880: PyThreadState_Get.PYTHON312 ref: 00007FF8B8CD38A2
Part of subcall function 00007FF8B8CD3880: PyErr_Fetch.PYTHON312 ref: 00007FF8B8CD38BA
Part of subcall function 00007FF8B8CD3880: PyCode_NewEmpty.PYTHON312 ref: 00007FF8B8CD38CD
Part of subcall function 00007FF8B8CD3880: PyFrame_New.PYTHON312 ref: 00007FF8B8CD38E7
Part of subcall function 00007FF8B8CD3880: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD3902
Part of subcall function 00007FF8B8CD3880: _PyErr_ChainExceptions1.PYTHON312 ref: 00007FF8B8CD390D

Strings

reset, xrefs: 00007FF8B8CD940B
charset_normalizer.md.MessDetectorPlugin, xrefs: 00007FF8B8CD93F8

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_$ChainCode_DeallocEmptyExceptions1FetchFormatFrame_State_SubtypeThreadType_
String ID: charset_normalizer.md.MessDetectorPlugin$reset
API String ID: 2783664582-4122180197
Opcode ID: 76f6fa13b8723754b9a60dd584603b75876082391e851e7e34e3c089995dae12
Instruction ID: 91c1ea5c4173055c6f27c43c53f76a4d34adb711630454209752ed2ee00609f9
Opcode Fuzzy Hash: 76f6fa13b8723754b9a60dd584603b75876082391e851e7e34e3c089995dae12
Instruction Fuzzy Hash: 6C0140E4E1810642EBF5AF6E98690B512A1AF44BC1F444036CF1D47796DF2CF947CB08

Function 00007FF8B8CE23B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

PyImport_Import.PYTHON312 ref: 00007FF8B8CE23C0
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE23F5

Strings

<module>, xrefs: 00007FF8B8CE3822

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocImportImport_
String ID: <module>
API String ID: 187899110-217463007
Opcode ID: d69bcf240f74489f4bd497fc0b8f2cc414bf2c6a77f5002b559556706f64d9ad
Instruction ID: 8f8817d0cc0e8d2df37c7a7d77a9a499171461ff5aa1c955b0a4130f0bdfaf4b
Opcode Fuzzy Hash: d69bcf240f74489f4bd497fc0b8f2cc414bf2c6a77f5002b559556706f64d9ad
Instruction Fuzzy Hash: 8B0116E5E09A0383F7A59F1DE8681782351AF847D2F448435DB2D07A54DF2DB5478708

Function 00007FF8B8CE3533 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8B8CE3552
_Py_Dealloc.PYTHON312 ref: 00007FF8B8CE3570

Strings

<module>, xrefs: 00007FF8B8CE3822

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: DeallocDict_Item
String ID: <module>
API String ID: 1953171116-217463007
Opcode ID: d0256b5094a83c2cce43499a17dbe8ec4dca85f9fba9f3344b29a1cf4ce49e16
Instruction ID: 12d3b9afc5fe6ec262be27a9ac6ecdd8df50c6db9c3804ff1bd5477db410ea08
Opcode Fuzzy Hash: d0256b5094a83c2cce43499a17dbe8ec4dca85f9fba9f3344b29a1cf4ce49e16
Instruction Fuzzy Hash: F0011EE1E0A60682FBA19B2DD86C1782790AF40BD6F444435DB2D077A5DF2DF5438708

Function 00007FF8B8CD5390 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD53AA

Strings

bool, xrefs: 00007FF8B8CD53C7
'TooManySymbolOrPunctuationPlugin' object attribute '_frenzy_symbol_in_word' cannot be deleted, xrefs: 00007FF8B8CD53A0

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_frenzy_symbol_in_word' cannot be deleted$bool
API String ID: 1450464846-825057536
Opcode ID: 7687b87dcfade708e71cb8af8033597d5e5aa7a4328c8a6f7437823f4d63887e
Instruction ID: 9c2bcbcc9762b401898c98c0a62de8686d3a8807866a66ee1805d6caa65ce7fb
Opcode Fuzzy Hash: 7687b87dcfade708e71cb8af8033597d5e5aa7a4328c8a6f7437823f4d63887e
Instruction Fuzzy Hash: 30F05EE5F1594282DB94972DD8A80342361AB547E2FA45236C62D422A4EF6CF89BC704

Function 00007FF8B8CD9350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON312 ref: 00007FF8B8CD9364

Part of subcall function 00007FF8B8CD3520: PyObject_IsInstance.PYTHON312 ref: 00007FF8B8CD3530
Part of subcall function 00007FF8B8CD3520: PyObject_CallNoArgs.PYTHON312 ref: 00007FF8B8CD3542
Part of subcall function 00007FF8B8CD3520: PyErr_SetObject.PYTHON312 ref: 00007FF8B8CD3556
Part of subcall function 00007FF8B8CD3520: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD356A

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD9388

Strings

reset, xrefs: 00007FF8B8CD9395

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Object_$Dealloc$ArgsAttrCallErr_InstanceObject
String ID: reset
API String ID: 1069087923-1352515405
Opcode ID: bbdd62e7f99f6cbdd23793489bb35b56453e91b9374609213c62ce4e8be85285
Instruction ID: 575680ba0f04f5793f1c47f614f5c576a8abea81890d42648f4601baba35f604
Opcode Fuzzy Hash: bbdd62e7f99f6cbdd23793489bb35b56453e91b9374609213c62ce4e8be85285
Instruction Fuzzy Hash: 45F054D9D0960681FBB47F2DA82C17453A09F48BD1F445031CB1C06794DF2CF5468B08

Function 00007FF8B8CD8950 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD896A

Strings

'ArchaicUpperLowerPlugin' object attribute '_current_ascii_only' cannot be deleted, xrefs: 00007FF8B8CD8960
bool, xrefs: 00007FF8B8CD8987

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_current_ascii_only' cannot be deleted$bool
API String ID: 1450464846-1261582747
Opcode ID: 8c7019ae60389a316b38f34d8583e21c126b8065cf809baa2539fb2ca883be19
Instruction ID: 2f44c0dcf2531ef89bcdda5b8030d862c6edc53b348f562e9ae4e3c683794d1e
Opcode Fuzzy Hash: 8c7019ae60389a316b38f34d8583e21c126b8065cf809baa2539fb2ca883be19
Instruction Fuzzy Hash: 45F05EE1E0594282DFA4A72DDCA80242361AB547E1FA45636C72C466A4EF2CF89BC708

Function 00007FF8B8CD82C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD82DA

Strings

bool, xrefs: 00007FF8B8CD82F7
'ArchaicUpperLowerPlugin' object attribute '_buf' cannot be deleted, xrefs: 00007FF8B8CD82D0

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_buf' cannot be deleted$bool
API String ID: 1450464846-2595685569
Opcode ID: 5445f695030172c0d74eedf3e058939476bfcef05161a035b360ea2110cf5acd
Instruction ID: 4776961b457c9e766fe7ea7bef53ce1c1f61599e3bdbc7ff4aed9d3c16786d7b
Opcode Fuzzy Hash: 5445f695030172c0d74eedf3e058939476bfcef05161a035b360ea2110cf5acd
Instruction Fuzzy Hash: 6FF05EE5E05A4282DF94972DD8B80242361AB587D2FA44635C62C422A4EF2CF99BC708

Function 00007FF8B8CD90F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON312 ref: 00007FF8B8CD9104

Part of subcall function 00007FF8B8CD3520: PyObject_IsInstance.PYTHON312 ref: 00007FF8B8CD3530
Part of subcall function 00007FF8B8CD3520: PyObject_CallNoArgs.PYTHON312 ref: 00007FF8B8CD3542
Part of subcall function 00007FF8B8CD3520: PyErr_SetObject.PYTHON312 ref: 00007FF8B8CD3556
Part of subcall function 00007FF8B8CD3520: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD356A

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD9128

Strings

eligible, xrefs: 00007FF8B8CD9135

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Object_$Dealloc$ArgsAttrCallErr_InstanceObject
String ID: eligible
API String ID: 1069087923-1278981203
Opcode ID: c4c18aafb7be077d316736c03388e8b3fc999084a9cdbfa9803da876a134bb0e
Instruction ID: b119755a0d6107b550876cc5e22e3a875bdfa1f881e8196c7a2587b2b73a55e2
Opcode Fuzzy Hash: c4c18aafb7be077d316736c03388e8b3fc999084a9cdbfa9803da876a134bb0e
Instruction Fuzzy Hash: EFF0FEE9E0960682FFB47F6DAC6D27513A0AF48BD1F442031CA1D06755EF2CF5868B09

Function 00007FF8B8CD7490 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD74AA

Strings

'SuperWeirdWordPlugin' object attribute '_foreign_long_watch' cannot be deleted, xrefs: 00007FF8B8CD74A0
bool, xrefs: 00007FF8B8CD74C7

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_foreign_long_watch' cannot be deleted$bool
API String ID: 1450464846-232606992
Opcode ID: f25d8b8b92148edbd20cfea33d340808ff6923455f8f104a8005e1d37519fff6
Instruction ID: 41667e4d4d6c23d3228a4c5d4055f0c60110af69a65262769b50f17408a19c0a
Opcode Fuzzy Hash: f25d8b8b92148edbd20cfea33d340808ff6923455f8f104a8005e1d37519fff6
Instruction Fuzzy Hash: 2EF05EE5F09A4282DB94972DDCB80342361AB547D1FA45236D62C426A5EF2CF89BCB04

Function 00007FF8B8CD9450 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON312 ref: 00007FF8B8CD9464

Part of subcall function 00007FF8B8CD3520: PyObject_IsInstance.PYTHON312 ref: 00007FF8B8CD3530
Part of subcall function 00007FF8B8CD3520: PyObject_CallNoArgs.PYTHON312 ref: 00007FF8B8CD3542
Part of subcall function 00007FF8B8CD3520: PyErr_SetObject.PYTHON312 ref: 00007FF8B8CD3556
Part of subcall function 00007FF8B8CD3520: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD356A

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD9488

Strings

ratio, xrefs: 00007FF8B8CD9495

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Object_$Dealloc$ArgsAttrCallErr_InstanceObject
String ID: ratio
API String ID: 1069087923-4234197119
Opcode ID: 5e78501f0d171a08875d62dc5a220b8c7582ed247167608e56f1788c768f6b2b
Instruction ID: 54450bc5804220fc451fbe8792563589a5f6ad0535e25980b3764986a07ccfba
Opcode Fuzzy Hash: 5e78501f0d171a08875d62dc5a220b8c7582ed247167608e56f1788c768f6b2b
Instruction Fuzzy Hash: B6F01DA8D0960682FBB56B2DA82C23563A09F48BC5F045031CB1D06A56DF3CF5868708

Function 00007FF8B8CD7400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8B8CD741A

Strings

'SuperWeirdWordPlugin' object attribute '_is_current_word_bad' cannot be deleted, xrefs: 00007FF8B8CD7410
bool, xrefs: 00007FF8B8CD7437

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_is_current_word_bad' cannot be deleted$bool
API String ID: 1450464846-604167972
Opcode ID: 6d01e49ecab393e01afea90eacf9c2f202f3be594d726ec8172ccd587fa77b69
Instruction ID: f513b473d0feb90493f5d8a7dab9f3e1dd6088e5c17a64e625e356aee3f4e11a
Opcode Fuzzy Hash: 6d01e49ecab393e01afea90eacf9c2f202f3be594d726ec8172ccd587fa77b69
Instruction Fuzzy Hash: B7F05EE5F1594292DB94972DE8B80242360BB547D1FA45235CB3C462A5EF2CF89BCB04

Function 00007FF8B8CD9220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON312 ref: 00007FF8B8CD9234

Part of subcall function 00007FF8B8CD3520: PyObject_IsInstance.PYTHON312 ref: 00007FF8B8CD3530
Part of subcall function 00007FF8B8CD3520: PyObject_CallNoArgs.PYTHON312 ref: 00007FF8B8CD3542
Part of subcall function 00007FF8B8CD3520: PyErr_SetObject.PYTHON312 ref: 00007FF8B8CD3556
Part of subcall function 00007FF8B8CD3520: _Py_Dealloc.PYTHON312 ref: 00007FF8B8CD356A

_Py_Dealloc.PYTHON312 ref: 00007FF8B8CD9258

Strings

feed, xrefs: 00007FF8B8CD9265

Memory Dump Source

Source File: 00000003.00000002.2173776460.00007FF8B8CD1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B8CD0000, based on PE: true

Associated: 00000003.00000002.2173671838.00007FF8B8CD0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173801830.00007FF8B8CE5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173821015.00007FF8B8CEB000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000003.00000002.2173839731.00007FF8B8CEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8cd0000_LKEAHetlG6.jbxd

Similarity

API ID: Object_$Dealloc$ArgsAttrCallErr_InstanceObject
String ID: feed
API String ID: 1069087923-591414443
Opcode ID: ac8b0854f2a92f6ab02b8bc2362475409b68329c589d35864c18ec7a585ccd28
Instruction ID: 9ea079849d7a7b80ea4ea1594f696785a3bb9c8dd9d5ef6e7457eed8cd1ef6e1
Opcode Fuzzy Hash: ac8b0854f2a92f6ab02b8bc2362475409b68329c589d35864c18ec7a585ccd28
Instruction Fuzzy Hash: 40F0D0D9D0960681FBF5AB69A86C27563909F48BD1F441031CE1D06759DF2CF5468B48

Function 00007FF8B8B29D80 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8B8B29DDD
memmove.VCRUNTIME140 ref: 00007FF8B8B352D1
memcpy.VCRUNTIME140 ref: 00007FF8B8B352E8

Memory Dump Source

Source File: 00000003.00000002.2171047789.00007FF8B8B21000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B8B20000, based on PE: true

Associated: 00000003.00000002.2170694572.00007FF8B8B20000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B38000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171171481.00007FF8B8B3C000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171412752.00007FF8B8B44000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000003.00000002.2171732687.00007FF8B8B45000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b8b20000_LKEAHetlG6.jbxd

Similarity

API ID: memcpy$memmove
String ID:
API String ID: 1283327689-0
Opcode ID: eee6edfa71bb2dedfcc37b73b2f55b6b239783ac4416e26ed470dd15ede7d960
Instruction ID: 93de5bc15cf53ddd7a0802ffb3b4dbd83ec3c2ebf9429bc2d1abfb18797e2906
Opcode Fuzzy Hash: eee6edfa71bb2dedfcc37b73b2f55b6b239783ac4416e26ed470dd15ede7d960
Instruction Fuzzy Hash: D831F432B4864983DB24AE3AA80447DBB61F754BD0F680139DF9E17B85DF3CE4568708

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LKEAHetlG6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI63402\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI63402\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI63402\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI63402\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI63402\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI63402\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI63402\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI63402\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-console-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-datetime-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-debug-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-errorhandling-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-file-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-file-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-file-l2-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-handle-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-heap-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-interlocked-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-libraryloader-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-localization-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-memory-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63402\api-ms-win-core-namedpipe-l1-1-0.dll

Windows Analysis Report
LKEAHetlG6.exe