Edit tour

Windows Analysis Report
cPl7CoJTBx.exe

Overview

General Information

Sample name:	cPl7CoJTBx.exe renamed because original name is a hash value
Original sample name:	32554d2f5dcd9927b21b43dda85359c2.exe
Analysis ID:	1533849
MD5:	32554d2f5dcd9927b21b43dda85359c2
SHA1:	cfc29320a821c84661de03ef07f96d6e0f9a707a
SHA256:	e68f4ed80cc5d1c699653e106b4f36693dc45c0e571b9a71a1f010b1516a2271
Tags:	exeuser-abuse_ch
Infos:

Detection

Luna Grabber, Luna Logger

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Luna Grabber

Yara detected Luna Logger

AI detected suspicious sample

Tries to harvest and steal WLAN passwords

Uses netsh to modify the Windows network and firewall settings

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to detect if online games are installed (MineCraft, World Of Warcraft etc)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

cPl7CoJTBx.exe (PID: 5972 cmdline: "C:\Users\user\Desktop\cPl7CoJTBx.exe" MD5: 32554D2F5DCD9927B21B43DDA85359C2)

cPl7CoJTBx.exe (PID: 6784 cmdline: "C:\Users\user\Desktop\cPl7CoJTBx.exe" MD5: 32554D2F5DCD9927B21B43DDA85359C2)

cmd.exe (PID: 4440 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5340 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2192800204.0000024E26D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LunaGrabber	Yara detected Luna Grabber	Joe Security
00000002.00000002.2192800204.0000024E26D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2192800204.0000024E26D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LunaLogger	Yara detected Luna Logger	Joe Security

Sigma Signatures

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\cPl7CoJTBx.exe", ParentImage: C:\Users\user\Desktop\cPl7CoJTBx.exe, ParentProcessId: 6784, ParentProcessName: cPl7CoJTBx.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", ProcessId: 4440, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: cPl7CoJTBx.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: cPl7CoJTBx.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.5% probability

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82CCD30 CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,EVP_MD_get0_provider,EVP_MD_free,EVP_MD_get0_provider,EVP_MD_free,EVP_CIPHER_get0_provider,EVP_CIPHER_free,EVP_MD_get0_provider,EVP_MD_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A82CCD30
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82C4930 CRYPTO_get_ex_new_index,	2_2_00007FF8A82C4930
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82FE920 CRYPTO_free,	2_2_00007FF8A82FE920
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B1EE2 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,EVP_MD_get0_name,EVP_MD_is_a,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8A82B1EE2
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B139D memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	2_2_00007FF8A82B139D
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B2185 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FF8A82B2185
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B1893 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_strdup,ERR_new,ERR_set_debug,	2_2_00007FF8A82B1893
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B204F CRYPTO_free,CRYPTO_malloc,ERR_new,RAND_bytes_ex,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8A82B204F
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82C4990 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A82C4990
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B24EB CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8A82B24EB
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A83089F0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A83089F0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B17DF ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A82B17DF
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B114F CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FF8A82B114F
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B1A05 ERR_new,ERR_set_debug,ERR_set_error,ASN1_item_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,_time64,X509_free,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ASN1_item_free,	2_2_00007FF8A82B1A05
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B1492 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A82B1492
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82F2A50 SRP_Calc_u_ex,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,BN_clear_free,BN_clear_free,	2_2_00007FF8A82F2A50
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B4B30 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A82B4B30
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B1460 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_snprintf,	2_2_00007FF8A82B1460
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82C6B20 CRYPTO_THREAD_run_once,OPENSSL_sk_find,OPENSSL_sk_value,EVP_CIPHER_fetch,EVP_CIPHER_get_flags,	2_2_00007FF8A82C6B20
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82DEB10 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FF8A82DEB10
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B1A0F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_CIPHER_get_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,CRYPTO_memcmp,ERR_set_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_pop_to_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,strncmp,strncmp,strncmp,strncmp,strncmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8A82B1A0F
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82CEB48 CRYPTO_free,	2_2_00007FF8A82CEB48
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B1AB4 CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8A82B1AB4
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8314C40 ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FF8A8314C40
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82FEC10 CRYPTO_free,	2_2_00007FF8A82FEC10
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B4C00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A82B4C00
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82FEC70 CRYPTO_free,	2_2_00007FF8A82FEC70
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B257C ERR_new,ERR_set_debug,CRYPTO_free,BIO_clear_flags,BIO_set_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_cleanse,	2_2_00007FF8A82B257C
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B22D9 CRYPTO_malloc,CONF_parse_list,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A82B22D9
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82F8C80 CRYPTO_free,	2_2_00007FF8A82F8C80
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8308CA0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A8308CA0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B136B ERR_new,ERR_set_debug,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,ERR_new,ERR_set_debug,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A82B136B
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B1CBC EVP_MD_get_size,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A82B1CBC
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82F8D40 OPENSSL_cleanse,CRYPTO_free,	2_2_00007FF8A82F8D40

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt			Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\wheel-0.43.0.dist-info\LICENSE.txt			Jump to behavior

Source: cPl7CoJTBx.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2199885678.00007FF8A8C80000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: cPl7CoJTBx.exe, 00000002.00000002.2198795380.00007FF8A87CA000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: cPl7CoJTBx.exe, 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: cPl7CoJTBx.exe, 00000000.00000003.2073154685.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2208108365.00007FF8B8C14000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2071238043.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2211085945.00007FF8BA254000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: cPl7CoJTBx.exe, 00000002.00000002.2198795380.00007FF8A8732000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: cPl7CoJTBx.exe, 00000000.00000003.2071238043.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2211085945.00007FF8BA254000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2198795380.00007FF8A87CA000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb** source: cPl7CoJTBx.exe, 00000002.00000002.2201634321.00007FF8B0550000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2071366179.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2207729124.00007FF8B8B25000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2208509905.00007FF8B8CB3000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2201634321.00007FF8B0550000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2210713631.00007FF8B9F71000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2207429069.00007FF8B8AF7000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32crypt.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2201969213.00007FF8B27C1000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2208794270.00007FF8B8F8B000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2202155557.00007FF8B55F3000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32crypt.pdb!! source: cPl7CoJTBx.exe, 00000002.00000002.2201969213.00007FF8B27C1000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2072646366.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2207578964.00007FF8B8B13000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2208794270.00007FF8B8F8B000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2209715138.00007FF8B93CD000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2073154685.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2208108365.00007FF8B8C14000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2207923782.00007FF8B8B39000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2206337418.00007FF8B7DEF000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: cPl7CoJTBx.exe, 00000000.00000003.2071366179.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2207729124.00007FF8B8B25000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2206535158.00007FF8B7E0D000.00000002.00000001.01000000.00000013.sdmp

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7B3C583C0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C59280 FindFirstFileExW,FindClose,	0_2_00007FF7B3C59280
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C71874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7B3C71874
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C59280 FindFirstFileExW,FindClose,	2_2_00007FF7B3C59280
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF7B3C583C0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C71874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF7B3C71874

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File opened: c:\users\user\appdata\local\temp\_mei59722\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File opened: c:\users\user\appdata\local\temp\_mei59722\setuptools\_vendor\	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File opened: c:\users\user\appdata\local\temp\_mei59722\setuptools\_vendor\autocommand-2.2.2.dist-info\	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File opened: c:\users\user\appdata\local\temp\_mei59722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File opened: c:\users\user\appdata\local\temp\_mei59722\pywin32_system32\	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File opened: c:\users\user\appdata\local\temp\_mei59722\setuptools\_vendor\importlib_resources-6.4.0.dist-info\	Jump to behavior

Source: Joe Sandbox View

IP Address: 162.159.128.233 162.159.128.233

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: canary.discord.com
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: cPl7CoJTBx.exe, 00000002.00000002.2193097064.0000024E26FC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: cPl7CoJTBx.exe, 00000002.00000003.2168804083.0000024E260A6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169250026.0000024E26117000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174261424.0000024E2723F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174902533.0000024E27242000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175046470.0000024E27244000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171474340.0000024E26139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169465944.0000024E26135000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174902533.0000024E2720D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165681061.0000024E26082000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170209555.0000024E2720A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176970490.0000024E27215000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175775163.0000024E26140000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167259431.0000024E260A4000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174014879.0000024E271BF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167814516.0000024E26134000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2168425039.0000024E271B2000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174958335.0000024E2611B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169985190.0000024E26138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: cPl7CoJTBx.exe, 00000002.00000003.2164022667.0000024E27285000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163607321.0000024E2727C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue23606)
Source: cPl7CoJTBx.exe, 00000000.00000003.2071912657.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiC
Source: cPl7CoJTBx.exe, 00000000.00000003.2071781451.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081698007.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071912657.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2083836132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072948988.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072822067.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2095368103.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2078368269.000001D27E146000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2080990556.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: cPl7CoJTBx.exe, 00000000.00000003.2071781451.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081698007.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2078368269.000001D27E140000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071912657.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2083836132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072948988.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072822067.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2095368103.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2078368269.000001D27E146000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: cPl7CoJTBx.exe, 00000000.00000003.2071781451.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081698007.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071912657.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2083836132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072948988.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072822067.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2095368103.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2080990556.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073154685.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: cPl7CoJTBx.exe, 00000000.00000003.2071781451.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081698007.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2078368269.000001D27E140000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071912657.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2083836132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072948988.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072822067.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2095368103.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2080990556.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: cPl7CoJTBx.exe, 00000002.00000003.2165257059.0000024E25C80000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172232274.0000024E25C85000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164230258.0000024E25C33000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2168884335.0000024E25C85000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167925696.0000024E26099000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2189342885.0000024E2609A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165681061.0000024E26082000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165640183.0000024E25C82000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2173338612.0000024E2609A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171040296.0000024E25C85000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165099329.0000024E25C4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: cPl7CoJTBx.exe, 00000002.00000002.2191112360.0000024E265B6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167854517.0000024E265B5000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165424976.0000024E265B3000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2116359699.0000024E2658B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2115433715.0000024E26524000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2115433715.0000024E2658B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172600578.0000024E265B6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163348080.0000024E265AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: cPl7CoJTBx.exe, 00000002.00000003.2175433578.0000024E26497000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165927322.0000024E2644D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167506079.0000024E26496000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2190645673.0000024E26498000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: cPl7CoJTBx.exe, 00000002.00000002.2187128504.0000024E24184000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164068678.0000024E24155000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175849417.0000024E26708000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170078316.0000024E24184000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26704000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174517417.0000024E26704000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164949745.0000024E24172000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163731111.0000024E26704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2189289504.0000024E26093000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2168746873.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2179450496.0000024E26093000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170360000.0000024E26085000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2193370009.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169887930.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165681061.0000024E26082000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174218690.0000024E2608F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2173467112.0000024E26086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: cPl7CoJTBx.exe, 00000002.00000003.2175433578.0000024E26497000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165927322.0000024E2644D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167506079.0000024E26496000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2190645673.0000024E26498000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlL
Source: cPl7CoJTBx.exe, 00000002.00000003.2175433578.0000024E26497000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165927322.0000024E2644D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167506079.0000024E26496000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2190645673.0000024E26498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlym
Source: cPl7CoJTBx.exe, 00000002.00000003.2168746873.0000024E27137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: cPl7CoJTBx.exe, 00000002.00000002.2191602073.0000024E266E7000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175568813.0000024E266E6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163965120.0000024E266DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: cPl7CoJTBx.exe, 00000002.00000003.2168746873.0000024E27137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl1
Source: cPl7CoJTBx.exe, 00000002.00000003.2168746873.0000024E27137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: cPl7CoJTBx.exe, 00000002.00000002.2191602073.0000024E266E7000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175568813.0000024E266E6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163965120.0000024E266DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: cPl7CoJTBx.exe, 00000002.00000003.2168746873.0000024E27137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: cPl7CoJTBx.exe, 00000002.00000003.2175849417.0000024E26708000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26704000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174517417.0000024E26704000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163731111.0000024E26704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: cPl7CoJTBx.exe, 00000000.00000003.2071781451.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081698007.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071912657.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2083836132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072948988.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072822067.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2095368103.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2078368269.000001D27E146000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2080990556.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: cPl7CoJTBx.exe, 00000000.00000003.2071781451.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081698007.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2078368269.000001D27E140000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071912657.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2083836132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072948988.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072822067.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2095368103.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2078368269.000001D27E146000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: cPl7CoJTBx.exe, 00000000.00000003.2071781451.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081698007.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071912657.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2083836132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072948988.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072822067.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2095368103.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2080990556.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073154685.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: cPl7CoJTBx.exe, 00000000.00000003.2072646366.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: cPl7CoJTBx.exe, 00000000.00000003.2072646366.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA384
Source: cPl7CoJTBx.exe, 00000000.00000003.2071781451.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081698007.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2078368269.000001D27E140000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071912657.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2083836132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072948988.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072822067.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2095368103.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2078368269.000001D27E146000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: cPl7CoJTBx.exe, 00000002.00000003.2168804083.0000024E260A6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169250026.0000024E26117000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165681061.0000024E26082000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167259431.0000024E260A4000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174014879.0000024E271BF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2168425039.0000024E271B2000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174958335.0000024E2611B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: cPl7CoJTBx.exe, 00000002.00000003.2171474340.0000024E26139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169465944.0000024E26135000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174902533.0000024E2720D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170209555.0000024E2720A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176970490.0000024E27215000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167814516.0000024E26134000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169985190.0000024E26138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: cPl7CoJTBx.exe, 00000002.00000003.2168804083.0000024E260A6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169250026.0000024E26117000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174261424.0000024E2723F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174902533.0000024E27242000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175046470.0000024E27244000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165681061.0000024E26082000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170209555.0000024E2720A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167259431.0000024E260A4000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174958335.0000024E2611B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: cPl7CoJTBx.exe, 00000002.00000003.2164125438.0000024E2676B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164894401.0000024E2679F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2185598376.0000024E271C5000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2194442287.0000024E278F0000.00000004.00001000.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169842240.0000024E26214000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174117621.0000024E27172000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164529498.0000024E2678C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2193097064.0000024E26FC0000.00000004.00001000.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175705100.0000024E267B3000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2182195690.0000024E271C5000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2193539863.0000024E271C5000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169155805.0000024E2716E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26789000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165835830.0000024E261D1000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2168425039.0000024E271B2000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164465618.0000024E261D0000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2168191275.0000024E26202000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174014879.0000024E271C5000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169669699.0000024E267B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: cPl7CoJTBx.exe, 00000002.00000002.2193097064.0000024E26FC0000.00000004.00001000.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E266ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: cPl7CoJTBx.exe, 00000002.00000002.2192345659.0000024E26960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: cPl7CoJTBx.exe, 00000002.00000002.2192345659.0000024E26960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: cPl7CoJTBx.exe, 00000002.00000002.2192345659.0000024E26960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: cPl7CoJTBx.exe, 00000002.00000002.2192599915.0000024E26B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/zeJZl.
Source: cPl7CoJTBx.exe, 00000002.00000003.2165363492.0000024E26535000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2190834878.0000024E2655D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175645997.0000024E2655D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170858042.0000024E26535000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175073695.0000024E2655D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164972527.0000024E26535000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2180416659.0000024E2655D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: cPl7CoJTBx.exe, 00000002.00000003.2170167975.0000024E26205000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2182342703.0000024E26206000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165835830.0000024E261D1000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164465618.0000024E261D0000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2168191275.0000024E26202000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: cPl7CoJTBx.exe, 00000002.00000003.2165363492.0000024E26535000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169644519.0000024E2658D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164972527.0000024E26535000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167568891.0000024E2658B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2191030744.0000024E2658F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170679498.0000024E27168000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169553533.0000024E27166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170679498.0000024E27168000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169553533.0000024E27166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: cPl7CoJTBx.exe, 00000000.00000003.2081698007.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert
Source: cPl7CoJTBx.exe, 00000000.00000003.2071781451.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081698007.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2078368269.000001D27E140000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071912657.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2083836132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072948988.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072822067.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2095368103.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2078368269.000001D27E146000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: cPl7CoJTBx.exe, 00000000.00000003.2071781451.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081698007.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2078368269.000001D27E140000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071912657.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2083836132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072948988.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072822067.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2095368103.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2080990556.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: cPl7CoJTBx.exe, 00000000.00000003.2071781451.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081698007.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071912657.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2083836132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072948988.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072822067.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2095368103.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2078368269.000001D27E146000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2080990556.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: cPl7CoJTBx.exe, 00000000.00000003.2071781451.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081698007.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071912657.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2083836132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072948988.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072822067.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2095368103.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2080990556.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073154685.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: cPl7CoJTBx.exe, 00000002.00000002.2190329213.0000024E26320000.00000004.00001000.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2192225821.0000024E26840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: cPl7CoJTBx.exe, 00000002.00000003.2168804083.0000024E260A6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170167975.0000024E26205000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2186956930.0000024E24164000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169250026.0000024E26117000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164068678.0000024E24155000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2182342703.0000024E26206000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174310031.0000024E24163000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165681061.0000024E26082000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167259431.0000024E260A4000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165835830.0000024E261D1000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164465618.0000024E261D0000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2168191275.0000024E26202000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174958335.0000024E2611B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: cPl7CoJTBx.exe, 00000002.00000002.2191602073.0000024E266E7000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2193425362.0000024E27178000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169189135.0000024E27174000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175568813.0000024E266E6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163965120.0000024E266DE000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169155805.0000024E2716E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: cPl7CoJTBx.exe, 00000002.00000002.2193097064.0000024E26FC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163731111.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2191660424.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2177221576.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174517417.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2178670048.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175849417.0000024E26752000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: cPl7CoJTBx.exe, 00000002.00000003.2174783626.0000024E2726A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174261424.0000024E2723F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174902533.0000024E27242000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172879873.0000024E2726A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175046470.0000024E27244000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133842436.0000024E27252000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163607321.0000024E2726A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2193957088.0000024E2726C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170209555.0000024E2720A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2183294139.0000024E2726B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170679498.0000024E27168000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169553533.0000024E27166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: cPl7CoJTBx.exe, 00000002.00000003.2185717867.0000024E27111000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2185787422.0000024E27130000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170679498.0000024E27168000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169553533.0000024E27166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170679498.0000024E27168000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169553533.0000024E27166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170679498.0000024E27168000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169553533.0000024E27166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: cPl7CoJTBx.exe, 00000000.00000003.2089295274.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2090208880.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: cPl7CoJTBx.exe, 00000000.00000003.2090208880.000001D27E147000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2089382011.000001D27E147000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2089295274.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2090208880.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: cPl7CoJTBx.exe, 00000002.00000003.2109721866.0000024E261E2000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2192225821.0000024E26840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169189135.0000024E27174000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2191550126.0000024E266D7000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172166381.0000024E2718E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169155805.0000024E2716E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171134330.0000024E2717D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: cPl7CoJTBx.exe, 00000002.00000003.2171474340.0000024E26139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169465944.0000024E26135000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174902533.0000024E2720D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170209555.0000024E2720A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176970490.0000024E27215000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175775163.0000024E26140000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167814516.0000024E26134000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169985190.0000024E26138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: cPl7CoJTBx.exe, 00000000.00000003.2071781451.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081698007.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2078368269.000001D27E140000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071912657.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2083836132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072948988.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2072822067.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2095368103.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2078368269.000001D27E146000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: cPl7CoJTBx.exe, 00000002.00000003.2168804083.0000024E260A6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171422855.0000024E260A6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2189425956.0000024E260EF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172398238.0000024E260DF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172294285.0000024E260A8000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165681061.0000024E26082000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169189135.0000024E27174000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167259431.0000024E260A4000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2177875895.0000024E260EF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169155805.0000024E2716E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171134330.0000024E2717D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2193452477.0000024E27189000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: cPl7CoJTBx.exe, 00000002.00000003.2170167975.0000024E26205000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2182342703.0000024E26206000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165835830.0000024E261D1000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164465618.0000024E261D0000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2168191275.0000024E26202000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: cPl7CoJTBx.exe, 00000002.00000003.2168746873.0000024E27137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163731111.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2191660424.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2177221576.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174517417.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2178670048.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175849417.0000024E26752000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: cPl7CoJTBx.exe, 00000002.00000003.2174783626.0000024E2726A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174261424.0000024E2723F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174902533.0000024E27242000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172879873.0000024E2726A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175046470.0000024E27244000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133842436.0000024E27252000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163607321.0000024E2726A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2193957088.0000024E2726C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170209555.0000024E2720A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2183294139.0000024E2726B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: cPl7CoJTBx.exe, 00000002.00000002.2193796050.0000024E2723C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174902533.0000024E2720D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170209555.0000024E2720A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: cPl7CoJTBx.exe, 00000002.00000003.2163232574.0000024E26657000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164436171.0000024E26694000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163986795.0000024E26686000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2134521076.0000024E2667D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E266ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://backportstarfile.readthedocs.io/en/latest/?badge=latest
Source: cPl7CoJTBx.exe, 00000000.00000003.2088225485.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://badge.fury.io/py/autocommand)
Source: cPl7CoJTBx.exe, 00000000.00000003.2088225485.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://badge.fury.io/py/autocommand.svg)
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.jaraco.com/skeleton
Source: cPl7CoJTBx.exe, 00000002.00000002.2192599915.0000024E26B90000.00000004.00001000.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2192466256.0000024E26A60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue44497.
Source: cPl7CoJTBx.exe, 00000002.00000002.2194880444.0000024E27B54000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/icons/958782767255158876/a_0949440b832bda90a3b95dc43feb9fb7.gif?size=4096
Source: cPl7CoJTBx.exe, 00000002.00000002.2192800204.0000024E26D90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v6/users/
Source: cPl7CoJTBx.exe, 00000002.00000003.2108014722.0000024E26144000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2109234859.0000024E26144000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2111156754.0000024E26144000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2105758025.0000024E26144000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2105080556.0000024E26144000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2114553730.0000024E26144000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2116431231.0000024E26143000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2106201567.0000024E26144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: cPl7CoJTBx.exe, 00000002.00000002.2187287300.0000024E25AEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: cPl7CoJTBx.exe, 00000000.00000003.2088225485.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/argparse.html#description
Source: cPl7CoJTBx.exe, 00000000.00000003.2088225485.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/argparse.html#epilog
Source: cPl7CoJTBx.exe, 00000002.00000002.2187287300.0000024E25A70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: cPl7CoJTBx.exe, 00000002.00000002.2187287300.0000024E25AEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: cPl7CoJTBx.exe, 00000002.00000002.2187287300.0000024E25AEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: cPl7CoJTBx.exe, 00000002.00000002.2187287300.0000024E25AEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: cPl7CoJTBx.exe, 00000002.00000002.2187287300.0000024E25A70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: cPl7CoJTBx.exe, 00000002.00000002.2188492554.0000024E25DF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: cPl7CoJTBx.exe, 00000002.00000002.2188492554.0000024E25DF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: cPl7CoJTBx.exe, 00000002.00000002.2187287300.0000024E25AEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: cPl7CoJTBx.exe, 00000002.00000003.2164068678.0000024E24155000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176497877.0000024E24157000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2186931768.0000024E2415F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2178096243.0000024E24159000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2179235201.0000024E2415F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#module-importlib.resources
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: cPl7CoJTBx.exe, 00000002.00000003.2168133166.0000024E264AE000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171805840.0000024E264B3000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165927322.0000024E2644D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167506079.0000024E26496000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170405913.0000024E264AF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170470421.0000024E264B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
Source: cPl7CoJTBx.exe, 00000002.00000002.2192800204.0000024E26D90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: cPl7CoJTBx.exe, 00000000.00000003.2088160329.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fsf.org/
Source: cPl7CoJTBx.exe, 00000002.00000002.2192345659.0000024E26960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: cPl7CoJTBx.exe, 00000000.00000003.2088225485.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Lucretiel/autocommand
Source: cPl7CoJTBx.exe, 00000000.00000003.2088225485.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Lucretiel/autocommand/issues
Source: cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Lucretiel/autocommand/issues/18
Source: cPl7CoJTBx.exe, 00000002.00000003.2166756203.0000024E267CF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169308283.0000024E267D1000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2119188597.0000024E267D7000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169754319.0000024E267D8000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164616178.0000024E267C4000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2134241720.0000024E267BD000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26789000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: cPl7CoJTBx.exe, 00000002.00000002.2187128504.0000024E24184000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164068678.0000024E24155000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176497877.0000024E24157000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170078316.0000024E24184000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2186931768.0000024E2415F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2178096243.0000024E24159000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164949745.0000024E24172000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2179235201.0000024E2415F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/astral-sh/ruff
Source: cPl7CoJTBx.exe, 00000002.00000003.2119188597.0000024E2677B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2134467590.0000024E2675E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/backports.tarfile
Source: cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/backports.tarfile/actions/workflows/main.yml/badge.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/backports.tarfile/actions?query=workflow%3A%22tests%22
Source: cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/inflect
Source: cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/inflect/actions/workflows/main.yml/badge.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/inflect/actions?query=workflow%3A%22tests%22
Source: cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.collections
Source: cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.collections/actions/workflows/main.yml/badge.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.collections/actions?query=workflow%3A%22tests%22
Source: cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.context
Source: cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.context/actions/workflows/main.yml/badge.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.context/actions?query=workflow%3A%22tests%22
Source: cPl7CoJTBx.exe, 00000002.00000002.2192345659.0000024E26960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/keyring/commit/a85a7cbc6c909f8121660ed1f7b487f99a1c2bf7
Source: cPl7CoJTBx.exe, cPl7CoJTBx.exe, 00000002.00000002.2201760024.00007FF8B0561000.00000002.00000001.01000000.0000002F.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2202047636.00007FF8B27CE000.00000002.00000001.01000000.0000002E.sdmp	String found in binary or memory: https://github.com/mhammond/pywin32
Source: cPl7CoJTBx.exe, 00000002.00000002.2192345659.0000024E26960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/platformdirs/platformdirs
Source: cPl7CoJTBx.exe, 00000002.00000002.2193097064.0000024E26FC0000.00000004.00001000.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165306848.0000024E26657000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2173745225.0000024E26657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: cPl7CoJTBx.exe, 00000002.00000002.2192225821.0000024E26840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: cPl7CoJTBx.exe, 00000002.00000002.2192345659.0000024E26960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: cPl7CoJTBx.exe, 00000002.00000002.2190238933.0000024E26220000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: cPl7CoJTBx.exe, 00000002.00000002.2192599915.0000024E26B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml
Source: cPl7CoJTBx.exe, 00000002.00000002.2187287300.0000024E25A70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: cPl7CoJTBx.exe, 00000002.00000003.2179235201.0000024E2415F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: cPl7CoJTBx.exe, 00000002.00000002.2187128504.0000024E24184000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164068678.0000024E24155000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176497877.0000024E24157000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170078316.0000024E24184000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2186931768.0000024E2415F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2178096243.0000024E24159000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164949745.0000024E24172000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2179235201.0000024E2415F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: cPl7CoJTBx.exe, 00000002.00000003.2168804083.0000024E260A6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2117244378.0000024E260DD000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171422855.0000024E260A6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2108014722.0000024E26109000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2173516626.0000024E26110000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2107078475.0000024E2649E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172398238.0000024E260DF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2106038051.0000024E2649E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172294285.0000024E260A8000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165681061.0000024E26082000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2111156754.0000024E260FF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167259431.0000024E260A4000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2114553730.0000024E260FF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2106201567.0000024E2606E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2109721866.0000024E260FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/issues
Source: cPl7CoJTBx.exe, 00000002.00000003.2111156754.0000024E26074000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2192225821.0000024E26840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
Source: cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_resources
Source: cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_resources/actions/workflows/main.yml/badge.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_resources/actions?query=workflow%3A%22tests%22
Source: cPl7CoJTBx.exe, 00000002.00000003.2164125438.0000024E2676B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176602013.0000024E2644F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165927322.0000024E2644D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172468097.0000024E2676B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174700570.0000024E2644F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2190521143.0000024E2644F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/requests/toolbelt/issues/75
Source: cPl7CoJTBx.exe, 00000002.00000003.2176374231.0000024E26586000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169804213.0000024E26586000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165363492.0000024E26535000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164972527.0000024E26535000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2168056195.0000024E26585000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/requests/toolbelt/issues/80
Source: cPl7CoJTBx.exe, 00000002.00000002.2187128504.0000024E24184000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164068678.0000024E24155000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176497877.0000024E24157000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170078316.0000024E24184000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2186931768.0000024E2415F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2178096243.0000024E24159000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164949745.0000024E24172000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2179235201.0000024E2415F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: cPl7CoJTBx.exe, 00000002.00000002.2192800204.0000024E26D90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: cPl7CoJTBx.exe, 00000002.00000003.2175433578.0000024E26497000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165927322.0000024E2644D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167506079.0000024E26496000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2190645673.0000024E26498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: cPl7CoJTBx.exe, 00000002.00000002.2193097064.0000024E26FC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: cPl7CoJTBx.exe, 00000002.00000002.2193097064.0000024E26FC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/29200r
Source: cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26789000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167351364.0000024E25BCF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2173039046.0000024E25BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: cPl7CoJTBx.exe, 00000002.00000003.2119543195.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175137763.0000024E26796000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164125438.0000024E2676B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165363492.0000024E26535000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164529498.0000024E2678C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166065807.0000024E26794000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2119188597.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169644519.0000024E2658D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164972527.0000024E26535000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167568891.0000024E2658B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2191030744.0000024E2658F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26789000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: cPl7CoJTBx.exe, 00000002.00000003.2176238336.0000024E26064000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: cPl7CoJTBx.exe, 00000002.00000003.2119543195.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175433578.0000024E26497000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165927322.0000024E2644D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167506079.0000024E26496000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2119716243.0000024E267A8000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2190645673.0000024E26498000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2119188597.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: cPl7CoJTBx.exe, 00000002.00000003.2173039046.0000024E25BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: cPl7CoJTBx.exe, 00000002.00000002.2193097064.0000024E26FC0000.00000004.00001000.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2173415996.0000024E2681D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165306848.0000024E26657000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2177221576.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26704000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174517417.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2178670048.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175849417.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167259431.0000024E260A4000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2177221576.0000024E2670E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2173745225.0000024E26657000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2192155393.0000024E2681E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174517417.0000024E26704000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163731111.0000024E26704000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174958335.0000024E2611B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: cPl7CoJTBx.exe, 00000002.00000003.2164125438.0000024E2676B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163731111.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176044922.0000024E2676D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172468097.0000024E2676B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172468097.0000024E2675E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/image/png
Source: cPl7CoJTBx.exe, 00000002.00000002.2190521143.0000024E2644F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
Source: cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/backports.tarfile.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_resources.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/inflect.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/jaraco.collections.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/jaraco.context.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/backports.tarfile.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/importlib_resources.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/inflect.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/jaraco.collections.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/jaraco.context.svg
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-metadata.readthedocs.io/
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
Source: cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/
Source: cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/?badge=latest
Source: cPl7CoJTBx.exe, 00000002.00000002.2192225821.0000024E26840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inflect.readthedocs.io/en/latest/?badge=latest
Source: cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jaracocollections.readthedocs.io/en/latest/?badge=latest
Source: cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jaracocontext.readthedocs.io/en/latest/?badge=latest
Source: cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jaracotext.readthedocs.io/en/latest/#jaraco.text.WordSet
Source: cPl7CoJTBx.exe, 00000002.00000003.2175849417.0000024E26752000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: cPl7CoJTBx.exe, 00000002.00000002.2194880444.0000024E27B04000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lukasa.co.uk/2013/01/Choosing_SSL_Version_In_Requests/
Source: cPl7CoJTBx.exe, 00000002.00000003.2116431231.0000024E26143000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165068949.0000024E261A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: cPl7CoJTBx.exe, 00000002.00000003.2171474340.0000024E26139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169465944.0000024E26135000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175775163.0000024E26140000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167814516.0000024E26134000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169985190.0000024E26138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: cPl7CoJTBx.exe, 00000002.00000002.2192711752.0000024E26C90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
Source: cPl7CoJTBx.exe, 00000002.00000002.2192599915.0000024E26B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: cPl7CoJTBx.exe, 00000002.00000003.2170167975.0000024E26205000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2182342703.0000024E26206000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165835830.0000024E261D1000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164465618.0000024E261D0000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2168191275.0000024E26202000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the
Source: cPl7CoJTBx.exe, 00000002.00000002.2192599915.0000024E26B90000.00000004.00001000.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2192711752.0000024E26C90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://path.readthedocs.io/en/latest/api.html
Source: cPl7CoJTBx.exe, 00000002.00000003.2103002386.0000024E26143000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2102838486.0000024E26143000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2101967901.0000024E26143000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2190238933.0000024E26220000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: cPl7CoJTBx.exe, 00000002.00000002.2199885678.00007FF8A8C80000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/backports.tarfile
Source: cPl7CoJTBx.exe, 00000002.00000002.2192599915.0000024E26B90000.00000004.00001000.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2192711752.0000024E26C90000.00000004.00001000.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2192466256.0000024E26A60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/build/).
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/importlib_metadata
Source: cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/importlib_resources
Source: cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/inflect
Source: cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/jaraco.collections
Source: cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/jaraco.context
Source: cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E147000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091341436.000001D27E147000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/word2number/
Source: cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/backportstarfile/badge/?version=latest
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
Source: cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/importlib-resources/badge/?version=latest
Source: cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/inflect/badge/?version=latest
Source: cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/jaracocollections/badge/?version=latest
Source: cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/jaracocontext/badge/?version=latest
Source: cPl7CoJTBx.exe, 00000002.00000002.2192345659.0000024E26960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: cPl7CoJTBx.exe, 00000002.00000002.2191112360.0000024E265B6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167854517.0000024E265B5000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165424976.0000024E265B3000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2193097064.0000024E26FC0000.00000004.00001000.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172600578.0000024E265B6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163348080.0000024E265AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: cPl7CoJTBx.exe, 00000002.00000002.2193097064.0000024E26FC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.ioxe
Source: cPl7CoJTBx.exe, 00000002.00000002.2192711752.0000024E26C90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: cPl7CoJTBx.exe, 00000002.00000003.2103770258.0000024E261AE000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2104032759.0000024E2607E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: cPl7CoJTBx.exe, 00000002.00000003.2113045180.0000024E25C85000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166259263.0000024E25C8E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164230258.0000024E25C33000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2103770258.0000024E261AE000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164503580.0000024E25C8D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2103805412.0000024E2614C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: cPl7CoJTBx.exe, 00000002.00000002.2190329213.0000024E26320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: cPl7CoJTBx.exe, 00000002.00000002.2190329213.0000024E26320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages0
Source: cPl7CoJTBx.exe, 00000002.00000003.2103708946.0000024E26421000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2103770258.0000024E261AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;
Source: cPl7CoJTBx.exe, 00000002.00000003.2103708946.0000024E26421000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2103770258.0000024E261AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;r
Source: cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.readthedocs.io/en/latest/pkg_resources.html
Source: cPl7CoJTBx.exe, 00000002.00000003.2119188597.0000024E2677B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2134467590.0000024E2675E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
Source: cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-resources
Source: cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/badges/package/pypi/inflect
Source: cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/badges/package/pypi/jaraco.collections
Source: cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/badges/package/pypi/jaraco.context
Source: cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E147000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091341436.000001D27E147000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-PROJECT?utm_source=pypi-PROJECT&utm_medium=referral&utm_c
Source: cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
Source: cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-resources?utm_source=pypi-importlib-resources&u
Source: cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-inflect?utm_source=pypi-inflect&utm_medium=readme
Source: cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-jaraco.collections?utm_source=pypi-jaraco.collections&utm
Source: cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-jaraco.context?utm_source=pypi-jaraco.context&utm_medium=
Source: cPl7CoJTBx.exe, 00000002.00000003.2174261424.0000024E2723F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174902533.0000024E27242000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175046470.0000024E27244000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2194880444.0000024E27B54000.00000004.00001000.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170209555.0000024E2720A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2194442287.0000024E27980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://toolbelt.readthedocs.io/
Source: cPl7CoJTBx.exe, 00000002.00000003.2119543195.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2190085203.0000024E261D6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2119716243.0000024E267A8000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2119188597.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2173018902.0000024E261D6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171581300.0000024E261D2000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165835830.0000024E261D1000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164465618.0000024E261D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: cPl7CoJTBx.exe, 00000002.00000003.2171474340.0000024E26139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169465944.0000024E26135000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174902533.0000024E2720D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170209555.0000024E2720A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176970490.0000024E27215000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167814516.0000024E26134000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169985190.0000024E26138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: cPl7CoJTBx.exe, 00000002.00000003.2171474340.0000024E26139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169465944.0000024E26135000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174902533.0000024E2720D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170209555.0000024E2720A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176970490.0000024E27215000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175775163.0000024E26140000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167814516.0000024E26134000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169985190.0000024E26138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: cPl7CoJTBx.exe, 00000002.00000003.2172816998.0000024E2602D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2116587350.0000024E26563000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165473059.0000024E26027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: cPl7CoJTBx.exe, 00000002.00000003.2166756203.0000024E267CF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165136806.0000024E25BB8000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169308283.0000024E267D1000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2119493638.0000024E267BD000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2119188597.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164616178.0000024E267C4000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2134241720.0000024E267BD000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26789000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167351364.0000024E25BCF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2173039046.0000024E25BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: cPl7CoJTBx.exe, 00000002.00000003.2119543195.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175137763.0000024E26796000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164125438.0000024E2676B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164529498.0000024E2678C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166065807.0000024E26794000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2119188597.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176788173.0000024E2679A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26789000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: cPl7CoJTBx.exe, 00000002.00000003.2168159130.0000024E26506000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171858980.0000024E26511000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164972527.0000024E264C2000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2190807791.0000024E26514000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2116359699.0000024E2658B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2115433715.0000024E26524000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2115433715.0000024E2658B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170049489.0000024E26507000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166316017.0000024E264C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: cPl7CoJTBx.exe, 00000000.00000003.2074712864.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/
Source: cPl7CoJTBx.exe, 00000000.00000003.2074810274.000001D27E147000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2074712864.000001D27E147000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2074712864.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: cPl7CoJTBx.exe, 00000002.00000003.2171474340.0000024E26139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169465944.0000024E26135000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175775163.0000024E26140000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167814516.0000024E26134000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169985190.0000024E26138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2199351431.00007FF8A8874000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: cPl7CoJTBx.exe, 00000002.00000002.2191112360.0000024E265B6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167854517.0000024E265B5000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165424976.0000024E265B3000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172600578.0000024E265B6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163348080.0000024E265AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: cPl7CoJTBx.exe, 00000002.00000003.2116431231.0000024E26143000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165068949.0000024E261A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: cPl7CoJTBx.exe, 00000002.00000002.2200730975.00007FF8A8E13000.00000004.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: cPl7CoJTBx.exe, 00000002.00000002.2199885678.00007FF8A8C80000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: cPl7CoJTBx.exe, 00000002.00000003.2119493638.0000024E267BD000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2119188597.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26704000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174517417.0000024E26704000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163731111.0000024E26704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169189135.0000024E27174000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171191412.0000024E27190000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169155805.0000024E2716E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171134330.0000024E2717D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: cPl7CoJTBx.exe, 00000002.00000003.2175433578.0000024E26497000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165927322.0000024E2644D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167506079.0000024E26496000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2190645673.0000024E26498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: cPl7CoJTBx.exe, 00000002.00000003.2119543195.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175137763.0000024E26796000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164125438.0000024E2676B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165363492.0000024E26535000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164529498.0000024E2678C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166065807.0000024E26794000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2119188597.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169644519.0000024E2658D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164972527.0000024E26535000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167568891.0000024E2658B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2191030744.0000024E2658F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26789000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C75C00	0_2_00007FF7B3C75C00
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C589E0	0_2_00007FF7B3C589E0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C76964	0_2_00007FF7B3C76964
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C708C8	0_2_00007FF7B3C708C8
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C51000	0_2_00007FF7B3C51000
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C5ACAD	0_2_00007FF7B3C5ACAD
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C5A47B	0_2_00007FF7B3C5A47B
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C76418	0_2_00007FF7B3C76418
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C708C8	0_2_00007FF7B3C708C8
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C62C10	0_2_00007FF7B3C62C10
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C73C10	0_2_00007FF7B3C73C10
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C61B50	0_2_00007FF7B3C61B50
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C5A2DB	0_2_00007FF7B3C5A2DB
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C6DA5C	0_2_00007FF7B3C6DA5C
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C639A4	0_2_00007FF7B3C639A4
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C62164	0_2_00007FF7B3C62164
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C61944	0_2_00007FF7B3C61944
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C680E4	0_2_00007FF7B3C680E4
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C740AC	0_2_00007FF7B3C740AC
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C71874	0_2_00007FF7B3C71874
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C59800	0_2_00007FF7B3C59800
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C61F60	0_2_00007FF7B3C61F60
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C68794	0_2_00007FF7B3C68794
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C79728	0_2_00007FF7B3C79728
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C61740	0_2_00007FF7B3C61740
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C6DEF0	0_2_00007FF7B3C6DEF0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C69EA0	0_2_00007FF7B3C69EA0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C75E7C	0_2_00007FF7B3C75E7C
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C635A0	0_2_00007FF7B3C635A0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C6E570	0_2_00007FF7B3C6E570
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C65D30	0_2_00007FF7B3C65D30
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C61D54	0_2_00007FF7B3C61D54
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C76964	2_2_00007FF7B3C76964
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C51000	2_2_00007FF7B3C51000
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C5ACAD	2_2_00007FF7B3C5ACAD
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C5A47B	2_2_00007FF7B3C5A47B
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C76418	2_2_00007FF7B3C76418
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C708C8	2_2_00007FF7B3C708C8
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C62C10	2_2_00007FF7B3C62C10
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C73C10	2_2_00007FF7B3C73C10
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C75C00	2_2_00007FF7B3C75C00
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C61B50	2_2_00007FF7B3C61B50
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C5A2DB	2_2_00007FF7B3C5A2DB
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C6DA5C	2_2_00007FF7B3C6DA5C
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C589E0	2_2_00007FF7B3C589E0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C639A4	2_2_00007FF7B3C639A4
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C62164	2_2_00007FF7B3C62164
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C61944	2_2_00007FF7B3C61944
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C680E4	2_2_00007FF7B3C680E4
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C740AC	2_2_00007FF7B3C740AC
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C708C8	2_2_00007FF7B3C708C8
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C71874	2_2_00007FF7B3C71874
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C59800	2_2_00007FF7B3C59800
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C61F60	2_2_00007FF7B3C61F60
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C68794	2_2_00007FF7B3C68794
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C79728	2_2_00007FF7B3C79728
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C61740	2_2_00007FF7B3C61740
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C6DEF0	2_2_00007FF7B3C6DEF0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C69EA0	2_2_00007FF7B3C69EA0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C75E7C	2_2_00007FF7B3C75E7C
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C635A0	2_2_00007FF7B3C635A0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C6E570	2_2_00007FF7B3C6E570
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C65D30	2_2_00007FF7B3C65D30
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C61D54	2_2_00007FF7B3C61D54
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8011880	2_2_00007FF8A8011880
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A80112F0	2_2_00007FF8A80112F0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8146930	2_2_00007FF8A8146930
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8192950	2_2_00007FF8A8192950
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81599A0	2_2_00007FF8A81599A0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A813FA10	2_2_00007FF8A813FA10
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8194B20	2_2_00007FF8A8194B20
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A819BB00	2_2_00007FF8A819BB00
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81DFB10	2_2_00007FF8A81DFB10
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8186B40	2_2_00007FF8A8186B40
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8139B90	2_2_00007FF8A8139B90
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81E2BF0	2_2_00007FF8A81E2BF0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8133C10	2_2_00007FF8A8133C10
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A816CC59	2_2_00007FF8A816CC59
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81B4C70	2_2_00007FF8A81B4C70
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A818CC40	2_2_00007FF8A818CC40
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81C2C40	2_2_00007FF8A81C2C40
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A814CC40	2_2_00007FF8A814CC40
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81BACA0	2_2_00007FF8A81BACA0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81C8C80	2_2_00007FF8A81C8C80
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A817BC80	2_2_00007FF8A817BC80
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8180CE0	2_2_00007FF8A8180CE0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A818BCC0	2_2_00007FF8A818BCC0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A813BD30	2_2_00007FF8A813BD30
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8149D00	2_2_00007FF8A8149D00
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A815DDB0	2_2_00007FF8A815DDB0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8140DC0	2_2_00007FF8A8140DC0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8174E70	2_2_00007FF8A8174E70
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81CCEA0	2_2_00007FF8A81CCEA0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81ACF30	2_2_00007FF8A81ACF30
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81DDFE0	2_2_00007FF8A81DDFE0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81BBFC0	2_2_00007FF8A81BBFC0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81E4FC0	2_2_00007FF8A81E4FC0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8158020	2_2_00007FF8A8158020
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81D7060	2_2_00007FF8A81D7060
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8157040	2_2_00007FF8A8157040
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81E80B0	2_2_00007FF8A81E80B0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81BE0F0	2_2_00007FF8A81BE0F0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8134120	2_2_00007FF8A8134120
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81421E0	2_2_00007FF8A81421E0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81DB230	2_2_00007FF8A81DB230
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8152250	2_2_00007FF8A8152250
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81D62A0	2_2_00007FF8A81D62A0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81F42B0	2_2_00007FF8A81F42B0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A814D2B0	2_2_00007FF8A814D2B0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81492B0	2_2_00007FF8A81492B0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A815F2F0	2_2_00007FF8A815F2F0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81332F5	2_2_00007FF8A81332F5
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81E72C0	2_2_00007FF8A81E72C0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A817F2D0	2_2_00007FF8A817F2D0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8137336	2_2_00007FF8A8137336
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81BA300	2_2_00007FF8A81BA300
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81DA310	2_2_00007FF8A81DA310
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A815D310	2_2_00007FF8A815D310
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8197350	2_2_00007FF8A8197350
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81A43B0	2_2_00007FF8A81A43B0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A814C380	2_2_00007FF8A814C380
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81D7460	2_2_00007FF8A81D7460
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81D54A0	2_2_00007FF8A81D54A0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81394D0	2_2_00007FF8A81394D0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A817A510	2_2_00007FF8A817A510
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8134570	2_2_00007FF8A8134570
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81545A0	2_2_00007FF8A81545A0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81615A0	2_2_00007FF8A81615A0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A818B5B0	2_2_00007FF8A818B5B0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A815E5C0	2_2_00007FF8A815E5C0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A818E670	2_2_00007FF8A818E670
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8143650	2_2_00007FF8A8143650
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81B86B0	2_2_00007FF8A81B86B0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81906C0	2_2_00007FF8A81906C0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81E96C0	2_2_00007FF8A81E96C0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81A7750	2_2_00007FF8A81A7750
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81A27E6	2_2_00007FF8A81A27E6
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8134820	2_2_00007FF8A8134820
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81EA860	2_2_00007FF8A81EA860
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A819C840	2_2_00007FF8A819C840
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81E18A0	2_2_00007FF8A81E18A0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8175880	2_2_00007FF8A8175880
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A813288E	2_2_00007FF8A813288E
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A813A8C0	2_2_00007FF8A813A8C0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81E88D0	2_2_00007FF8A81E88D0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82E8920	2_2_00007FF8A82E8920
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B1EE2	2_2_00007FF8A82B1EE2
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B1618	2_2_00007FF8A82B1618
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B1A0F	2_2_00007FF8A82B1A0F
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B2617	2_2_00007FF8A82B2617
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A832AC80	2_2_00007FF8A832AC80
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B1CBC	2_2_00007FF8A82B1CBC
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A82B149C	2_2_00007FF8A82B149C

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: String function: 00007FF8A82B1325 appears 76 times
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: String function: 00007FF8A832D341 appears 215 times
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: String function: 00007FF7B3C52910 appears 34 times
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: String function: 00007FF8A832D32F appears 39 times
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: String function: 00007FF8A8161E20 appears 33 times
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: String function: 00007FF8A8139340 appears 136 times
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: String function: 00007FF8A813A500 appears 179 times
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: String function: 00007FF7B3C52710 appears 104 times

Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.0.dr

Static PE information: No import functions for PE file found

Source: cPl7CoJTBx.exe, 00000000.00000003.2071781451.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2081698007.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2071912657.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2071238043.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2087894222.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes312.dll0 vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2072948988.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2096900748.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32crypt.pyd0 vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2072822067.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2095368103.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2071366179.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2073154685.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000000.00000003.2072646366.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe	Binary or memory string: OriginalFilename vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2208314793.00007FF8B8C18000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2202248494.00007FF8B55F5000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2201760024.00007FF8B0561000.00000002.00000001.01000000.0000002F.sdmp	Binary or memory string: OriginalFilenamepywintypes312.dll0 vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2201271817.00007FF8A8F1E000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2211148138.00007FF8BA25A000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2207992186.00007FF8B8B43000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2207489936.00007FF8B8AFE000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2210853777.00007FF8B9F7E000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2209354696.00007FF8B8F94000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2208589667.00007FF8B8CB6000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2207638493.00007FF8B8B16000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2202047636.00007FF8B27CE000.00000002.00000001.01000000.0000002E.sdmp	Binary or memory string: OriginalFilenamewin32crypt.pyd0 vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilenamelibsslH vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2199351431.00007FF8A8874000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2207793292.00007FF8B8B29000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs cPl7CoJTBx.exe
Source: cPl7CoJTBx.exe, 00000002.00000002.2206401040.00007FF8B7DFB000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs cPl7CoJTBx.exe

Source: classification engine

Classification label: mal92.troj.spyw.evad.winEXE@8/203@2/1

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe

File created: C:\Users\user\AppData\Local\Luna-Logged-user.zip

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4268:120:WilError_03

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI59722

Jump to behavior

Source: cPl7CoJTBx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: cPl7CoJTBx.exe, 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: cPl7CoJTBx.exe, 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: cPl7CoJTBx.exe, 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: cPl7CoJTBx.exe, 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: cPl7CoJTBx.exe, cPl7CoJTBx.exe, 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: cPl7CoJTBx.exe, 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: cPl7CoJTBx.exe, 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: cPl7CoJTBx.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe

File read: C:\Users\user\Desktop\cPl7CoJTBx.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\cPl7CoJTBx.exe "C:\Users\user\Desktop\cPl7CoJTBx.exe"
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Process created: C:\Users\user\Desktop\cPl7CoJTBx.exe "C:\Users\user\Desktop\cPl7CoJTBx.exe"
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Process created: C:\Users\user\Desktop\cPl7CoJTBx.exe "C:\Users\user\Desktop\cPl7CoJTBx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: pywintypes312.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: cPl7CoJTBx.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: cPl7CoJTBx.exe

Static file information: File size 18991698 > 1048576

Source: cPl7CoJTBx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: cPl7CoJTBx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: cPl7CoJTBx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: cPl7CoJTBx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: cPl7CoJTBx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: cPl7CoJTBx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: cPl7CoJTBx.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: cPl7CoJTBx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2199885678.00007FF8A8C80000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2096141298.000001D27E139000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: cPl7CoJTBx.exe, 00000002.00000002.2198795380.00007FF8A87CA000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: cPl7CoJTBx.exe, 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: cPl7CoJTBx.exe, 00000000.00000003.2073154685.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2208108365.00007FF8B8C14000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2072337252.000001D27E137000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2071238043.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2211085945.00007FF8BA254000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: cPl7CoJTBx.exe, 00000002.00000002.2198795380.00007FF8A8732000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: cPl7CoJTBx.exe, 00000000.00000003.2071238043.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2211085945.00007FF8BA254000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2198795380.00007FF8A87CA000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb** source: cPl7CoJTBx.exe, 00000002.00000002.2201634321.00007FF8B0550000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2072264292.000001D27E137000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2071366179.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2207729124.00007FF8B8B25000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2088018132.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2208509905.00007FF8B8CB3000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2201634321.00007FF8B0550000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2210713631.00007FF8B9F71000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2072056189.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2207429069.00007FF8B8AF7000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32crypt.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2201969213.00007FF8B27C1000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2208794270.00007FF8B8F8B000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2073069077.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2202155557.00007FF8B55F3000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2071445123.000001D27E137000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32crypt.pdb!! source: cPl7CoJTBx.exe, 00000002.00000002.2201969213.00007FF8B27C1000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2072646366.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2207578964.00007FF8B8B13000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2072160748.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2208794270.00007FF8B8F8B000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2071544536.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2209715138.00007FF8B93CD000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2073154685.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2208108365.00007FF8B8C14000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2072718505.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2207923782.00007FF8B8B39000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2206337418.00007FF8B7DEF000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: cPl7CoJTBx.exe, 00000000.00000003.2081834227.000001D27E139000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: cPl7CoJTBx.exe, 00000000.00000003.2071366179.000001D27E137000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2207729124.00007FF8B8B25000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: cPl7CoJTBx.exe, 00000002.00000002.2206535158.00007FF8B7E0D000.00000002.00000001.01000000.00000013.sdmp

Source: cPl7CoJTBx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: cPl7CoJTBx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: cPl7CoJTBx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: cPl7CoJTBx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: cPl7CoJTBx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]

Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python312.dll.0.dr	Static PE information: section name: PyRuntim

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A7DC7425 push 60F5C5F1h; iretd	2_2_00007FF8A7DC742D
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A7DC4FEA push 6FFDC5C3h; iretd	2_2_00007FF8A7DC4FF0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A7DC4F9E push 6FFDC5CAh; ret	2_2_00007FF8A7DC4FA4
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A7DC4AEE push 6FFDC5D5h; iretd	2_2_00007FF8A7DC4AF4
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A7DC76D3 push 6FFDC5D5h; iretd	2_2_00007FF8A7DC76D9
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A7DC4640 push 60F5C5F1h; iretd	2_2_00007FF8A7DC4648
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A7DC79CF push 6FFDC5C3h; iretd	2_2_00007FF8A7DC79D5
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A7DC7983 push 6FFDC5CAh; ret	2_2_00007FF8A7DC7989
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A817267D push rbx; retf	2_2_00007FF8A8172685
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A81727AE push rsp; iretd	2_2_00007FF8A81727B9

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\pywin32_system32\pywintypes312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imagingcms.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imagingtk.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imaging.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_webp.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imagingmath.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Util\_strxor.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt			Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59722\wheel-0.43.0.dist-info\LICENSE.txt			Jump to behavior

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe

Code function: 0_2_00007FF7B3C55830 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF7B3C55830

Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imagingcms.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imagingtk.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imaging.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_webp.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imagingmath.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Util\_strxor.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17220

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe

API coverage: 2.8 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7B3C583C0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C59280 FindFirstFileExW,FindClose,	0_2_00007FF7B3C59280
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C71874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7B3C71874
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C59280 FindFirstFileExW,FindClose,	2_2_00007FF7B3C59280
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF7B3C583C0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C71874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF7B3C71874

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe

Code function: 2_2_00007FF8A8141230 GetSystemInfo,

2_2_00007FF8A8141230

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File opened: c:\users\user\appdata\local\temp\_mei59722\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File opened: c:\users\user\appdata\local\temp\_mei59722\setuptools\_vendor\	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File opened: c:\users\user\appdata\local\temp\_mei59722\setuptools\_vendor\autocommand-2.2.2.dist-info\	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File opened: c:\users\user\appdata\local\temp\_mei59722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File opened: c:\users\user\appdata\local\temp\_mei59722\pywin32_system32\	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	File opened: c:\users\user\appdata\local\temp\_mei59722\setuptools\_vendor\importlib_resources-6.4.0.dist-info\	Jump to behavior

Source: cPl7CoJTBx.exe, 00000000.00000003.2073665560.000001D27E137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: cPl7CoJTBx.exe, 00000002.00000003.2169091523.0000024E25C8F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2113045180.0000024E25C85000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2177949798.0000024E25C99000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166259263.0000024E25C8E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164230258.0000024E25C33000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164503580.0000024E25C8D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170029232.0000024E25C98000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2180496778.0000024E25C99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWN

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe

Code function: 0_2_00007FF7B3C5D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7B3C5D12C

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe

Code function: 0_2_00007FF7B3C73480 GetProcessHeap,

0_2_00007FF7B3C73480

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C5D30C SetUnhandledExceptionFilter,	0_2_00007FF7B3C5D30C
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C5D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7B3C5D12C
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C5C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7B3C5C8A0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 0_2_00007FF7B3C6A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7B3C6A614
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C5D30C SetUnhandledExceptionFilter,	2_2_00007FF7B3C5D30C
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C5D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF7B3C5D12C
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C5C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF7B3C5C8A0
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF7B3C6A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF7B3C6A614
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8013028 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8A8013028
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8012A70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8A8012A70
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Code function: 2_2_00007FF8A8262920 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8A8262920

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Process created: C:\Users\user\Desktop\cPl7CoJTBx.exe "C:\Users\user\Desktop\cPl7CoJTBx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe

Code function: 0_2_00007FF7B3C79570 cpuid

0_2_00007FF7B3C79570

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography-43.0.1.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\autocommand-2.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\autocommand-2.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\autocommand-2.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\autocommand-2.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\backports.tarfile-1.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\backports.tarfile-1.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\backports.tarfile-1.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_resources-6.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_resources-6.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_resources-6.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_resources-6.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_resources-6.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\inflect-7.3.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.collections-5.1.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.collections-5.1.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.context-5.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.context-5.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.functools-4.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.functools-4.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\more_itertools-10.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\packaging-24.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\packaging-24.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\packaging-24.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\packaging-24.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\platformdirs-4.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\platformdirs-4.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\platformdirs-4.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\platformdirs-4.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\tomli-2.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\tomli-2.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typing_extensions-4.12.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Queries volume information: C:\Users\user\Desktop\cPl7CoJTBx.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe

Code function: 0_2_00007FF7B3C5D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7B3C5D010

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe

Code function: 0_2_00007FF7B3C75C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF7B3C75C00

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Stealing of Sensitive Information

Yara detected Luna Grabber

Source: Yara match

File source: 00000002.00000002.2192800204.0000024E26D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Luna Logger

Source: Yara match

File source: 00000002.00000002.2192800204.0000024E26D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Users\user\Desktop\cPl7CoJTBx.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior

Source: C:\Users\user\Desktop\cPl7CoJTBx.exe

File opened / queried: C:\Users\user\AppData\Roaming\.minecraft

Jump to behavior

Source: Yara match

File source: 00000002.00000002.2192800204.0000024E26D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Luna Grabber

Source: Yara match

File source: 00000002.00000002.2192800204.0000024E26D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Luna Logger

Source: Yara match

File source: 00000002.00000002.2192800204.0000024E26D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cPl7CoJTBx.exe	53%	ReversingLabs	Win64.Trojan.ReverseShell
cPl7CoJTBx.exe	100%	Avira	OSX/GM.ReverseShe.TH

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_BLAKE2b.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_MD2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_MD4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_MD5.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_RIPEMD160.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA1.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA224.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA256.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA384.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA512.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_keccak.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_poly1305.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Math\_modexp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_curve25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_curve448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_ec_ws.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_ed25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_ed448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Util\_cpuid_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Util\_strxor.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imaging.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imagingcms.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imagingmath.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imagingtk.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_webp.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\_cffi_backend.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\charset_normalizer\md.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59722\libcrypto-3.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://wwww.certigna.fr/autorites/0m	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
http://www.firmaprofesional.com/cps0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://www.quovadisglobal.com/cps0	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://www.quovadisglobal.com/cps	0%	URL Reputation	safe
https://www.openssl.org/H	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
canary.discord.com	162.159.128.233	true	false		unknown
171.39.242.20.in-addr.arpa	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/jaraco/keyring/commit/a85a7cbc6c909f8121660ed1f7b487f99a1c2bf7	cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://img.shields.io/pypi/pyversions/backports.tarfile.svg	cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/astral-sh/ruff	cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/giampaolo/psutil/issues/875.	cPl7CoJTBx.exe, 00000002.00000003.2119188597.0000024E2677B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2134467590.0000024E2675E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://img.shields.io/pypi/v/jaraco.collections.svg	cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages	cPl7CoJTBx.exe, 00000002.00000002.2190329213.0000024E26320000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg	cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tidelift.com/badges/package/pypi/jaraco.context	cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/python/importlib_metadata/issues	cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#module-importlib.resources	cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	cPl7CoJTBx.exe, 00000002.00000002.2187128504.0000024E24184000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164068678.0000024E24155000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176497877.0000024E24157000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170078316.0000024E24184000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2186931768.0000024E2415F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2178096243.0000024E24159000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164949745.0000024E24172000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2179235201.0000024E2415F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://importlib-metadata.readthedocs.io/	cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://goo.gl/zeJZl.	cPl7CoJTBx.exe, 00000002.00000002.2192599915.0000024E26B90000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.apache.org/licenses/LICENSE-2.0	cPl7CoJTBx.exe, 00000000.00000003.2074810274.000001D27E147000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2074712864.000001D27E147000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2074712864.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	cPl7CoJTBx.exe, 00000002.00000003.2108014722.0000024E26144000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2109234859.0000024E26144000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2111156754.0000024E26144000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2105758025.0000024E26144000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2105080556.0000024E26144000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2114553730.0000024E26144000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2116431231.0000024E26143000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2106201567.0000024E26144000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/jaraco/inflect	cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/pypa/packaging	cPl7CoJTBx.exe, 00000002.00000002.2192225821.0000024E26840000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://pypi.org/project/backports.tarfile	cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://readthedocs.org/projects/importlib-metadata/badge/?version=latest	cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://refspecs.linuxfoundation.org/elf/gabi4	cPl7CoJTBx.exe, 00000002.00000002.2192345659.0000024E26960000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://crl.dhimyotis.com/certignarootca.crlL	cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://img.shields.io/pypi/pyversions/importlib_resources.svg	cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://readthedocs.org/projects/backportstarfile/badge/?version=latest	cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	cPl7CoJTBx.exe, 00000002.00000002.2192800204.0000024E26D90000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://blog.jaraco.com/skeleton	cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tools.ietf.org/html/rfc3610	cPl7CoJTBx.exe, 00000002.00000003.2171474340.0000024E26139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169465944.0000024E26135000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174902533.0000024E2720D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170209555.0000024E2720A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176970490.0000024E27215000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167814516.0000024E26134000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169985190.0000024E26138000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/platformdirs/platformdirs	cPl7CoJTBx.exe, 00000002.00000002.2192345659.0000024E26960000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://crl.dhimyotis.com/certignarootca.crl	cPl7CoJTBx.exe, 00000002.00000003.2175433578.0000024E26497000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165927322.0000024E2644D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167506079.0000024E26496000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2190645673.0000024E26498000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://curl.haxx.se/rfc/cookie_spec.html	cPl7CoJTBx.exe, 00000002.00000002.2193097064.0000024E26FC0000.00000004.00001000.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E266ED000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fsf.org/	cPl7CoJTBx.exe, 00000000.00000003.2088160329.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://img.shields.io/pypi/pyversions/inflect.svg	cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;	cPl7CoJTBx.exe, 00000002.00000003.2103708946.0000024E26421000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2103770258.0000024E261AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	cPl7CoJTBx.exe, 00000002.00000002.2187287300.0000024E25A70000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	cPl7CoJTBx.exe, 00000002.00000003.2119543195.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175137763.0000024E26796000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164125438.0000024E2676B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164529498.0000024E2678C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166065807.0000024E26794000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2119188597.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176788173.0000024E2679A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26789000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://img.shields.io/pypi/pyversions/jaraco.collections.svg	cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/jaraco/jaraco.context/actions?query=workflow%3A%22tests%22	cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://importlib-resources.readthedocs.io/en/latest/?badge=latest	cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://pypi.org/project/build/).	cPl7CoJTBx.exe, 00000002.00000002.2192599915.0000024E26B90000.00000004.00001000.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2192711752.0000024E26C90000.00000004.00001000.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2192466256.0000024E26A60000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://wwww.certigna.fr/autorites/0m	cPl7CoJTBx.exe, 00000002.00000003.2175433578.0000024E26497000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165927322.0000024E2644D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167506079.0000024E26496000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2190645673.0000024E26498000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	cPl7CoJTBx.exe, 00000002.00000002.2187128504.0000024E24184000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164068678.0000024E24155000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176497877.0000024E24157000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170078316.0000024E24184000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2186931768.0000024E2415F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2178096243.0000024E24159000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164949745.0000024E24172000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2179235201.0000024E2415F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/python/cpython/issues/86361.	cPl7CoJTBx.exe, 00000002.00000003.2168804083.0000024E260A6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2117244378.0000024E260DD000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171422855.0000024E260A6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2108014722.0000024E26109000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2173516626.0000024E26110000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2107078475.0000024E2649E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172398238.0000024E260DF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2106038051.0000024E2649E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172294285.0000024E260A8000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165681061.0000024E26082000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2111156754.0000024E260FF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167259431.0000024E260A4000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2114553730.0000024E260FF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2106201567.0000024E2606E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2109721866.0000024E260FF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tidelift.com/subscription/pkg/pypi-inflect?utm_source=pypi-inflect&utm_medium=readme	cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://httpbin.org/	cPl7CoJTBx.exe, 00000002.00000003.2173039046.0000024E25BD0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.apache.org/licenses/	cPl7CoJTBx.exe, 00000000.00000003.2074712864.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	cPl7CoJTBx.exe, 00000002.00000002.2188492554.0000024E25DF0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	cPl7CoJTBx.exe, 00000002.00000002.2188492554.0000024E25DF0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://img.shields.io/pypi/v/inflect.svg	cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://img.shields.io/badge/skeleton-2024-informational	cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the	cPl7CoJTBx.exe, 00000002.00000003.2170167975.0000024E26205000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2182342703.0000024E26206000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165835830.0000024E261D1000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164465618.0000024E261D0000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2168191275.0000024E26202000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	cPl7CoJTBx.exe, 00000002.00000003.2165363492.0000024E26535000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169644519.0000024E2658D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164972527.0000024E26535000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167568891.0000024E2658B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2191030744.0000024E2658F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://httpbin.org/image/png	cPl7CoJTBx.exe, 00000002.00000003.2164125438.0000024E2676B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163731111.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176044922.0000024E2676D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172468097.0000024E2676B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172468097.0000024E2675E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/pypa/setuptools/issues/417#issuecomment-392298401	cPl7CoJTBx.exe, 00000002.00000002.2190238933.0000024E26220000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://crl.securetrust.com/STCA.crl	cPl7CoJTBx.exe, 00000002.00000003.2168746873.0000024E27137000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Lucretiel/autocommand/issues	cPl7CoJTBx.exe, 00000000.00000003.2088225485.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170679498.0000024E27168000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169553533.0000024E27166000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tidelift.com/subscription/pkg/pypi-PROJECT?utm_source=pypi-PROJECT&utm_medium=referral&utm_c	cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E147000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091341436.000001D27E147000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.cert.fnmt.es/dpcs/	cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169189135.0000024E27174000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2191550126.0000024E266D7000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172166381.0000024E2718E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169155805.0000024E2716E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171134330.0000024E2717D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google.com/mail	cPl7CoJTBx.exe, 00000002.00000003.2119543195.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175137763.0000024E26796000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164125438.0000024E2676B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165363492.0000024E26535000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164529498.0000024E2678C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166065807.0000024E26794000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2119188597.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169644519.0000024E2658D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164972527.0000024E26535000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167568891.0000024E2658B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2191030744.0000024E2658F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26789000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://img.shields.io/pypi/v/importlib_metadata.svg	cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/jaraco/jaraco.functools/issues/5	cPl7CoJTBx.exe, 00000002.00000002.2192345659.0000024E26960000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.accv.es00	cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170679498.0000024E27168000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169553533.0000024E27166000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.rfc-editor.org/info/rfc7253	cPl7CoJTBx.exe, 00000002.00000003.2174783626.0000024E2726A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174261424.0000024E2723F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174902533.0000024E27242000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172879873.0000024E2726A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175046470.0000024E27244000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133842436.0000024E27252000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163607321.0000024E2726A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2193957088.0000024E2726C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170209555.0000024E2720A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2183294139.0000024E2726B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/jaraco/backports.tarfile/actions/workflows/main.yml/badge.svg	cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000000.00000003.2088793011.000001D27E13E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://readthedocs.org/projects/inflect/badge/?version=latest	cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	cPl7CoJTBx.exe, 00000002.00000003.2175433578.0000024E26497000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165927322.0000024E2644D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167506079.0000024E26496000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2190645673.0000024E26498000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mahler:8092/site-updates.py	cPl7CoJTBx.exe, 00000002.00000003.2116431231.0000024E26143000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165068949.0000024E261A7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tools.ietf.org/html/rfc7231#section-4.3.6)	cPl7CoJTBx.exe, 00000002.00000003.2172816998.0000024E2602D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2116587350.0000024E26563000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165473059.0000024E26027000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.firmaprofesional.com/cps0	cPl7CoJTBx.exe, 00000002.00000003.2168804083.0000024E260A6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171422855.0000024E260A6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2189425956.0000024E260EF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172398238.0000024E260DF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172294285.0000024E260A8000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165681061.0000024E26082000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169189135.0000024E27174000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167259431.0000024E260A4000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2177875895.0000024E260EF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169155805.0000024E2716E000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171134330.0000024E2717D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2193452477.0000024E27189000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	cPl7CoJTBx.exe, 00000002.00000002.2187287300.0000024E25AEC000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/urllib3/urllib3/issues/2920	cPl7CoJTBx.exe, 00000002.00000002.2193097064.0000024E26FC0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://crl.securetrust.com/SGCA.crl0	cPl7CoJTBx.exe, 00000002.00000002.2191602073.0000024E266E7000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175568813.0000024E266E6000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163965120.0000024E266DE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	cPl7CoJTBx.exe, 00000002.00000003.2164068678.0000024E24155000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176497877.0000024E24157000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2186931768.0000024E2415F000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2178096243.0000024E24159000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2179235201.0000024E2415F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.securetrust.com/SGCA.crl1	cPl7CoJTBx.exe, 00000002.00000003.2168746873.0000024E27137000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://img.shields.io/pypi/v/importlib_resources.svg	cPl7CoJTBx.exe, 00000000.00000003.2090489076.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22	cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://pypi.org/project/jaraco.context	cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.quovadisglobal.com/cps0	cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2163731111.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2191660424.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2177221576.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174517417.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2178670048.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175849417.0000024E26752000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/jaraco/jaraco.collections/actions/workflows/main.yml/badge.svg	cPl7CoJTBx.exe, 00000000.00000003.2091718252.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml	cPl7CoJTBx.exe, 00000002.00000002.2192599915.0000024E26B90000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://docs.python.org/library/itertools.html#recipes	cPl7CoJTBx.exe, 00000002.00000002.2192345659.0000024E26960000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/jaraco/inflect/actions/workflows/main.yml/badge.svg	cPl7CoJTBx.exe, 00000000.00000003.2091255848.000001D27E139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://readthedocs.org/projects/jaracocontext/badge/?version=latest	cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca	cPl7CoJTBx.exe, 00000002.00000002.2192345659.0000024E26960000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/jaraco/jaraco.context	cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/pypa/setuptools/issues/1024.	cPl7CoJTBx.exe, 00000002.00000002.2192345659.0000024E26960000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	cPl7CoJTBx.exe, 00000002.00000003.2165257059.0000024E25C80000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2172232274.0000024E25C85000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164230258.0000024E25C33000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2168884335.0000024E25C85000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167925696.0000024E26099000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2189342885.0000024E2609A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165681061.0000024E26082000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165640183.0000024E25C82000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2173338612.0000024E2609A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2171040296.0000024E25C85000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165099329.0000024E25C4A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.discordapp.com/icons/958782767255158876/a_0949440b832bda90a3b95dc43feb9fb7.gif?size=4096	cPl7CoJTBx.exe, 00000002.00000002.2194880444.0000024E27B54000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://ocsp.accv.es0	cPl7CoJTBx.exe, 00000002.00000003.2166887589.0000024E2714A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170679498.0000024E27168000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164305535.0000024E27149000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169553533.0000024E27166000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.python.org/	cPl7CoJTBx.exe, 00000002.00000003.2116431231.0000024E26143000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165068949.0000024E261A7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm	cPl7CoJTBx.exe, 00000000.00000003.2089409921.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/howto/mro.html.	cPl7CoJTBx.exe, 00000002.00000002.2187287300.0000024E25AEC000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://twitter.com/	cPl7CoJTBx.exe, 00000002.00000003.2166756203.0000024E267CF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165136806.0000024E25BB8000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169308283.0000024E267D1000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2119493638.0000024E267BD000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2119188597.0000024E2678B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164616178.0000024E267C4000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2134241720.0000024E267BD000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26789000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167351364.0000024E25BCF000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2173039046.0000024E25BD0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/questions/4457745#4457745.	cPl7CoJTBx.exe, 00000002.00000003.2119188597.0000024E2677B000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2133866349.0000024E26752000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2134467590.0000024E2675E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://requests.readthedocs.ioxe	cPl7CoJTBx.exe, 00000002.00000002.2193097064.0000024E26FC0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.quovadisglobal.com/cps	cPl7CoJTBx.exe, 00000002.00000003.2168746873.0000024E27137000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google.com/mail/	cPl7CoJTBx.exe, 00000002.00000003.2176238336.0000024E26064000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://google.com/mail/	cPl7CoJTBx.exe, 00000002.00000003.2170167975.0000024E26205000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2182342703.0000024E26206000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2165835830.0000024E261D1000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164465618.0000024E261D0000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2168191275.0000024E26202000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://path.readthedocs.io/en/latest/api.html	cPl7CoJTBx.exe, 00000000.00000003.2092218994.000001D27E13C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tools.ietf.org/html/rfc5297	cPl7CoJTBx.exe, 00000002.00000003.2171474340.0000024E26139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2164819979.0000024E26081000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169465944.0000024E26135000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2174902533.0000024E2720D000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2170209555.0000024E2720A000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2176970490.0000024E27215000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2175775163.0000024E26140000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2167814516.0000024E26134000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000003.2169985190.0000024E26138000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.openssl.org/H	cPl7CoJTBx.exe, 00000000.00000003.2081154558.000001D27E139000.00000004.00000020.00020000.00000000.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmp, cPl7CoJTBx.exe, 00000002.00000002.2199351431.00007FF8A8874000.00000002.00000001.01000000.00000012.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.159.128.233	canary.discord.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1533849
Start date and time:	2024-10-15 09:31:58 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cPl7CoJTBx.exe renamed because original name is a hash value
Original Sample Name:	32554d2f5dcd9927b21b43dda85359c2.exe
Detection:	MAL
Classification:	mal92.troj.spyw.evad.winEXE@8/203@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 74 Number of non-executed functions: 234
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
VT rate limit hit for: cPl7CoJTBx.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.128.233	file.exe	Get hash	malicious	LummaC, Glupteba, PureLog Stealer, RisePro Stealer, SmokeLoader, Stealc, zgRAT	Browse	discord.com/phpMyAdmin/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
canary.discord.com	e45AiBoV6X.exe	Get hash	malicious	Blank Grabber	Browse	162.159.137.232
	Built (1).exe	Get hash	malicious	Blank Grabber	Browse	162.159.128.233
	GalacticShooter (3).exe	Get hash	malicious	Unknown	Browse	162.159.136.232
	GalacticShooter (3).exe	Get hash	malicious	Unknown	Browse	162.159.128.233
	322pVOVprx.exe	Get hash	malicious	Creal Stealer	Browse	162.159.128.233
	S3zoj9Uts0.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	uBZeAVcb6r.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	12057ad2.exe	Get hash	malicious	NitroRansomware	Browse	162.159.138.232
	build (2).exe	Get hash	malicious	Stealerium	Browse	162.159.136.232
	Evo_Spoofer_V2.exe	Get hash	malicious	Hog Grabber	Browse	162.159.135.232

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	R6IuO0fzec.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.3.16
	Salary Increase Letter_Oct 2024.vbs	Get hash	malicious	Remcos, GuLoader	Browse	188.114.97.3
	Request for Quotation MK FMHS.RFQ.10.24.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Swift Payment 20241014839374.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	Request for Quotation MK FMHS.RFQ.10.24.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Request for Quotation MK FMHS.RFQ.10.24_PDF.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Halkbank,pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SMX-ACH0036173.vbs	Get hash	malicious	FormBook, GuLoader	Browse	188.114.96.3
	Purchase Order.js	Get hash	malicious	AgentTesla	Browse	172.66.0.235
	PAYMENT APPLICATION.xls	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	Zip archive data (empty)
Category:	dropped
Size (bytes):	22
Entropy (8bit):	1.0476747992754052
Encrypted:	false
SSDEEP:	3:pjt/l:Nt
MD5:	76CDB2BAD9582D23C1F6F4D868218D6C
SHA1:	B04F3EE8F5E43FA3B162981B50BB72FE1ACABB33
SHA-256:	8739C76E681F900923B900C9DF0EF75CF421D39CABB54650C4B9AD19B6A76D85
SHA-512:	5E2F959F36B66DF0580A94F384C5FC1CEEEC4B2A3925F062D7B68F21758B86581AC2ADCFDDE73A171A28496E758EF1B23CA4951C05455CDAE9357CC3B5A5825F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	PK....................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.64091077287031
Encrypted:	false
SSDEEP:	192:dGklddyTHThob0q/tJRrlDONYSOcqgYCWt:EgcdZq/JJDFgRWt
MD5:	F3A0DEF1BA9F7CF5DA771F5E7C29CA3F
SHA1:	21CA5BCB23A55A7FE41AF810C1B0E5DCAEB25C16
SHA-256:	362C42BD62E5751E9B647BD575D483CC510DC862AB6098E6893EDCF3F44A567E
SHA-512:	659DC896767501A8B7690CE944AA7A6D60A5F0596C32E2E2B0E8D4BF85434C25337BB6835A386CEAAEE245B9A5E9A06415196B9BDC115668373388D693DC747E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d....B.f.........." ................P........................................p............`..........................................'......0(..d....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.019697132100443
Encrypted:	false
SSDEEP:	192:4t/1nCuqaL0kt7AznuRmceS4lDhhAlcqgcLg:F/k1ACln4lDkgcLg
MD5:	2CE3043D6FBD62BCBE6948A1E6A789F0
SHA1:	7A5E9BC5A96BD2EC677927FB014073E7CDB70F3B
SHA-256:	C5A4AC8202A0211163938B6306E3A678CC461ED8E283F4C4601748D2E50783A3
SHA-512:	8FCA5216D65C66640541B31E21A7EB18F510C5C0D3420BFF5581337875A6F68DD808F35D61A759A26AAD9AE4F50AA1580E8D90E016D9ACDC5AA2D04CFAAD4377
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d....B.f.........." ................P.....................................................`..........................................8......H9..d....`.......P..L............p..(....1...............................1..8............0...............................text...h........................... ..`.rdata..r....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.038085765012569
Encrypted:	false
SSDEEP:	192:st/1nCuqaL0ktPMn1ENe3erKr5br0YbsiDA6a9lkOcqgRGd:p/kpMIodrXbsiDC95gRGd
MD5:	0BE007DD183DAF0F4B65E73CF19EA139
SHA1:	272275DA46E02B3C0F856E14F4FB27A0F4B0494E
SHA-256:	F6308DACB781C99D3B962451FC681973808792936690AF6AA7FA5B6DF40F4EAF
SHA-512:	F4F06C03239E262C5500E5E64AB4F8B71BF90EDE3B8157B572BF36F303DAE2D81DB2B063DF30E8D5E555A51B07A42264E19B68D25006BC31B4EA27F3FBE1E023
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d....B.f.........." ................P.....................................................`......................................... 8.......8..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.09241379083317
Encrypted:	false
SSDEEP:	192:rDVsiXeqVb0lIb0Pj5Jdfpm68WZDFnU282tacqgYLg:rD7ali0Pj5JxCaDpUlgYLg
MD5:	1831D77E3247E859A1BD4311637D5D17
SHA1:	730355120C6079AC3B38DD5E7FD0CF656CF604C2
SHA-256:	B04AB30C7AD39D852854AA0CCD9508D213EAA1B1D070B27D3679C1CBB53FAFC6
SHA-512:	5B208AC5C00CAF8C49FA82264308CC1379F1F83391CF6EDDEB1A35BCE6E7459F28CE6ABD5E32229A4CF1D096E05C59C96BE405F061E6883290BD27CC65D2E81E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d....B.f.........." ................P.....................................................`.........................................`8.......8..d....`.......P..(............p..(....1...............................1..8............0...............................text............................... ..`.rdata..6....0....... ..............@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.5414219614027544
Encrypted:	false
SSDEEP:	384:m/UlZA5PUEllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52EkifcMxmP:RlcR7JriEbwDaS4j990th9VgBV
MD5:	E306365BDC8D15B2F477E5AF252D0B59
SHA1:	E6461FD5079050D129CD47CD4F6AFA7B632C4314
SHA-256:	2DCAC73EA3240A008D115BAC0EA4D7C65C8162676AB30BCAF7527C22B98B4929
SHA-512:	1B63A9ADCF6A37F601B8E1BD6206EC369A618C81F1C3477301053219DB1DDECC27B5AEB9E7AD7490C7E987BA196884D66E85BB5B7F4DAD43BFFF891310E11945
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d....B.f.........." .....H...H......P.....................................................`.........................................p...........d...............................0......................................8............`...............................text...xG.......H.................. ..`.rdata.."6...`...8...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.367966872597574
Encrypted:	false
SSDEEP:	192:QJBj5fq/Rk0kPLhOZ3UucCWuSKPEkA2bDMJXx03cqg5YUMLgs:Sk1kTMZEjCWNaA2D4x0g5YUMLg
MD5:	973F11DE023C9337F35F9BB55C6154A6
SHA1:	C02FF64D9FC5B8B8590488BBE9658593FC90CA47
SHA-256:	483758336267F8842F5432BB83300EA0FCB49C4E0B29962CBD7F27B1C3DFC56A
SHA-512:	8658ADE868C9D942660361A60C5B4068238B418857BBBD4B1712DE5A146300F435960A75C411E1737E590020644309C92A2DCFDA69A2D6162A4135244A282871
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d....B.f.........." ......... ......P.....................................................`..........................................9......$:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.411163759850271
Encrypted:	false
SSDEEP:	192:a3d9FkHaz0EJvrj+CYuz7ucc9dG7otDrM2KcqgOiewZjW:ekHEJzj+X6769lD1agO/w
MD5:	31F8353B80EA438AA705A7986DF24ED3
SHA1:	3BBA2691BA37884AC5DD6397456EC1D46E2D25C0
SHA-256:	89A51C145166DD24CF83D358ADE292B23F20B94BE783D5FE33A9DA2D7F2C14EB
SHA-512:	8CC35583EF842164A29F23E9A643898C622003654E551DADBBB6DD309017ABD886D2BDC491472B21ED8816B0619A521B70934FD8CD2614BAABC2DADEED237FA6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d....B.f.........." ....."... ......P.....................................................`.........................................pI.......J..d....p.......`..................(....B...............................B..8............@...............................text...( .......".................. ..`.rdata..<....@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..(............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.041327291179631
Encrypted:	false
SSDEEP:	384:CUX0JfbRz5MLZA0nmwzMDYpJgLa0Mp8zDBcxgprAM:0NbRzWXwDqgLa1wBfP
MD5:	F86637FA9E2246C36B6FFB90CA83E66C
SHA1:	BA04C29B14B39295CE0C9CE1F1B8444DC7EDF275
SHA-256:	933330BD2D55DE985B45BDD12B99291B4507C830CD6CC9E917CEDD1E49E878EC
SHA-512:	128B6322338C7B262B2BA6155FADC798E6F59011810B7A4501BBBECE19EA20CB857BFD180B0AB727347ACEE651949A45FB4183445293853698B4F42E999C47DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d....B.f.........." .....$...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data...H....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.530672619544914
Encrypted:	false
SSDEEP:	384:pEDwUBi9SPu71omZXmrfXA+UA10ol31tuX8YdAgYj:CsUBXmoEXmrXA+NNxWMYfo
MD5:	AC98B10064264B49DE13F66E60CD47B5
SHA1:	C14CA2E042F6FA11135CE824F14A14E3625D1A97
SHA-256:	8621AC7A3E09367BB0C529FDD3D178F20EDFA193FE0D19A02DE424A6BBA45229
SHA-512:	A30EA39A36FC58B888E10F2C4C8B075787B03019C0408F0083D2A6A30707380841E6A6A726ADF5F24013AE5B481D3998541EB3C29F9744DB95D4BD53287835D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d....B.f.........." .....$...>............................................................`..........................................h.......i..d...............................0....a...............................a..8............@...............................text....#.......$.................. ..`.rdata..:-...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7088945967294356
Encrypted:	false
SSDEEP:	192:EF/1n7Guqaj0ktfEJwX1fYwCOD03lncqg0Gd6l:+GXkJEm1feODaDg0Gd6
MD5:	8D17946E6B1936061203AFE20CDDB5B0
SHA1:	589DAC4D2864FDC0219B0DE3973B2EE0023CD5EA
SHA-256:	BB9898057572F17131BB63D513C19901E29D2E29215F7A93D6D84FA537475F0B
SHA-512:	3354942781E4D36B84D83AB6959707D29F6E25D3614B15A228D63D084F6F2A280BFC9153F24EA0FEF489FA7043E21EB67E4B6D3AD7D073FDE37F6206462F5931
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d....B.f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.159801367034206
Encrypted:	false
SSDEEP:	192:kZlRgfeqfz0RP767fB4A84D+VD6eDcqgzbkLgmf:jwRj67p84Dm6eVgzbkLgmf
MD5:	606E85B094AE6752E1099A176AA20F09
SHA1:	35E9355CE75B57111D3793502636D5FCD78D34A4
SHA-256:	917FA3438B61CC207D73BD72CDA6C42CD08656A2187FD9CA2860C67C12677238
SHA-512:	19DE7B6C567E997825F2F08773C45A3562BC3980248DE31738395CAFA0306707A82F912A8B9B1DBA440162443E1554E87EF5586776189B763576D9A7ACA9E587
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d....B.f.........." ................P.....................................................`..........................................8......x9..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata..d....P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.270331451319695
Encrypted:	false
SSDEEP:	192:vrtJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDsVMcqgnF6+6Lg:vrdU1ID3AdXd49urQPDbgnUjLg
MD5:	F3CFD044825E9C08CE37A8034E2ED786
SHA1:	51637C5678AEDF528ADEF8036C53513495FCBB44
SHA-256:	BCBE37F565B91A127E40634DB8E7E1B8B1CE3E1344F3FA082496B93D75435B80
SHA-512:	FD9F8AE46A438138C31408EBF9129DD507A8FD6DC24F24EAE2B2DD8BD90E8B78AFB0AEF82A314CA5566D4D1BB7D166642DD2E7D7EA8E484C0261F623B2C1C15B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d....B.f.........." ......... ......P.....................................................`.........................................`9.......:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	4.231023773248046
Encrypted:	false
SSDEEP:	384:EqcmHBeNL1dO/qHkpnYcZiGKdZHDLY84vnKAnK2rZw21agVF:vEiqHHx4vZTV
MD5:	FE88CD3248814691F951330F780E351C
SHA1:	4DF59A4BC3A3F72BCAADEC80C3326BEBB7D7213E
SHA-256:	BB692D568653FBB9414A050665A94ABB42905AC4343A30ECDC2953C4F840631F
SHA-512:	2E90F8DF00609DDAA14A3174DC844EF8E2D26F49E8A2C086251B0643916C84CC6605CE67C6C5A98753C8095BCC63453F64C7A0AA956547A62B7F82C7487502A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d....B.f.........." .....6...................................................0............`.................................................\...d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.2524132143312645
Encrypted:	false
SSDEEP:	384:Z4cmHBeIzNweVy/CHkRnYcZiGKdZHDLq80vnKAnKBrZWsURygUX:2EO6CHnX0vZn7
MD5:	17DEF19C3094153CC6CF76B7DAA71553
SHA1:	62E1D370F232C9421C9DEDB28DE2078B43D08651
SHA-256:	C20CD1A2A9082551F0F37B87AEDE89BFFDBD02B38BF03D0E73AEBAC3733DCC4D
SHA-512:	E2FBCF2729AB3972B65F35813BCE4E434160C7F798FB2C98088551D055C05ED1D49A8F3BD9D1C522B0D28CD120EB6A4BC9FACFC44674340ADB3FE45AA1FAC292
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d....B.f.........." .....8...................................................0............`.....................................................d............................ ..0... ...............................@...8............P...............................text...X7.......8.................. ..`.rdata......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.691147079095514
Encrypted:	false
SSDEEP:	192:Bddz2KTnThIz0qfteRY4zp+DUPLui8p1cqgHCWt:t2E9RqfCXp+DUjuRpLgiWt
MD5:	4DB0AC98329AE64CEC9C28570AF52968
SHA1:	8F7D327C1049C27B0DF6BC6C2017CC302BA99A10
SHA-256:	5A43E3809403668ED6C6F17A71828EB8CD0DCB64AFC09B815A4B9F05C3661714
SHA-512:	515E0B972A644620C27B3C074AEE62B8BA5AA679B0E1C936F616C5537A83C7CA762B7A6C7ACC3279AB235D1D344DB9423CDC1ABF7C72775D4BBFB2CB24CBF6B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d....B.f.........." ................P........................................p............`.........................................0'.......'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.121802927133552
Encrypted:	false
SSDEEP:	384:0UX0JfbRwUtPMbNv37t6K5jwbDEpJgLa0Mp8mJCkgJrAm:KNbRw8EbxwKBwbD+gLa1ch
MD5:	257E449799177D7F43EB1B8ED6180C1C
SHA1:	E023424CCBDCE4EF3CC5D0A723FE2D2E02363CAB
SHA-256:	8425C2E412045DA204419B41D80D6538636F13FD187F7F8A259F29F5380A2536
SHA-512:	944070BD07EDB03BC8EC599D26D3B182F27A71DA2DB1C79CA01914F5637AE1BB9C47E0F2D56C8FC1433E325C1BAF903E330BE123C0CB36E6F355FF5DB649D9FA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d....B.f.........." .....(...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text...H'.......(.................. ..`.rdata.......@... ...,..............@..@.data...H....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..0............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.293998683514664
Encrypted:	false
SSDEEP:	384:XPHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgD93iNgnVbwhA:iUOhBcDRogeXOfoTezcio3pUJgD93i+
MD5:	ED75912A048CA3C2E0FE8E7307559347
SHA1:	BB0998846468A91A5FB6D9725439C2F62E02CC21
SHA-256:	EB1085A28631FE3C8B3350B19DDDC5C2EAF9B2CBF1C578FDFBF6B72FDF0B909C
SHA-512:	C04F62F57E0395EC731180F6CE9568A35C00BE51AE172F2F6EEE4D9D6726F5BDC41A55E8043D596E9724CCEE00F861F349E3F787FC3C1B5ADB47F8C194A23FB1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d....B.f.........." .....(... ......P.....................................................`.........................................pI......lJ..d....p.......`..................(....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	4.86291799390376
Encrypted:	false
SSDEEP:	96:ra+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDCLk+VOmWbucX6gRCk:dF/1n7Guqaj0ktfEON+bMDClJcqg0Gd
MD5:	DAE7F4DD6792FB84C91BD45D44ED6C96
SHA1:	A88EB81D4D72ADC4C7F7402338F9D5760957EFC3
SHA-256:	01EB2117F0223F0447CD16B5EC79BAF3430871DA8EF461404BA13592D2E8A89C
SHA-512:	66E98AE82073ABB24E9053203F41CEBB4AC30A461FE2A62BAA1190970E1BE7567F495914E017EC94B6B911BAB721E63A7FF2D1D85E29D5824AB3D9BC9FB9FCE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d....B.f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......$..............@....pdata..X....P.......&..............@..@.rsrc........`.......*..............@..@.reloc..(....p.......,..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.227344334667063
Encrypted:	false
SSDEEP:	192:7aF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDi4clG6VcqgOvgdd:7wGXkFE8Zo+AojO9jZeD85rgOvgz
MD5:	607DD619A4BBB03D587D5D4C6A145B25
SHA1:	CC3024641B61EB3F8DB9BFBC3CEA72EAA2F58FE3
SHA-256:	944598CCCB552A1E00DBD3915F11BAB5E38E8B1AE2ADC05BCDEAED42F28723FC
SHA-512:	C3C2B22377747CD9A8F19218A048EA55523AE384EAD43492662D1DDB54281E0AF8E2C34B815CD4AFA96A65CF407DE89745B1E74A5830FEA19F3B9500A0086C0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d....B.f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...x........................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.1766092054656285
Encrypted:	false
SSDEEP:	192:yF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreDLmf1AoxkVcqgOvgXQ:IGXkFE/UW575tA2eDy1Ao2rgOvgX
MD5:	1DEE6707A941E02202A47C58408ED538
SHA1:	511387A5A611119BA81377931DA5A8DA5C429B78
SHA-256:	4E76A0BE3E295571172CF1D06DBCC48F715357BB496D8567D9376667326FA5EF
SHA-512:	F29063D04151C9DF75CA2C138FBA5F9E4DA551F0FDFA7A8A83390DF0DCDE064038BA87EEC4C852A87D80CEF0DC38306AED1121D06A6B337E4CC722E4057C432A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d....B.f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.0474332549987055
Encrypted:	false
SSDEEP:	384:HalCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHDgCIg5kP:gCvHmp3OpnEhmLg9yH8puzoFaPERIQg1
MD5:	B75BE9023BA98415A8ED687A4115B0C9
SHA1:	860ADADC887580255B0C9580392AF7CA8155D7A6
SHA-256:	3E04C68EBF4834B8F9CCD1AFD29302E2D76B03874D8611BBD6E8750CD18AA317
SHA-512:	7B566F523635EA0D7082D564A4E13EEFC254D1A6DC27593FB79DF2E76C95BC24E3CF4637C19505BD709BF44D5110666C1373C9936F5A84ED51D86093F2F2188A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d....B.f.........." ......... ......P.....................................................`.........................................@9.......9..d....`.......P..(............p..(....2...............................2..8............0...............................text...X........................... ..`.rdata..@....0......................@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.099563420082932
Encrypted:	false
SSDEEP:	192:hsiXeqVb0lwbH4P01sAD7I/9hAkwDmzBEbcqgqLg:/alqH4M1sAD7KvpwDVtgqLg
MD5:	B0A744729C904B9955D580A919AF5F28
SHA1:	04B9346C7935945EF796BE8A46304F43162C6C02
SHA-256:	D2341DA9A7EE7D88CDD61FB008A2F5D66D386129DCA52B60745B9A6FC996A428
SHA-512:	F1D42900B7108AD2A82DC13BB9605972873EAE000C76BFDFAAA338A634DB114E4893642CBB532D9DA1C5FA762833ACCA3F6F287E4D379515452600A4A3591679
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d....B.f.........." ................P.....................................................`.........................................08.......8..d....`.......P..(............p..(....1...............................2..8............0...............................text............................... ..`.rdata..0....0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.45178953834791
Encrypted:	false
SSDEEP:	384:XfwogDHER1wuiDSyoGTgDcOviNgEPrLg:vgDHELwuiDScTgDBi+EP
MD5:	0D56F87EED6685569C363CD7B482FF0E
SHA1:	10EC6EA5D10CB98312B463E681C71A69CB529B11
SHA-256:	88E5A5508C7F672D130C2BAD89A892670967A8DF9B07DC479C37E00D3A23F8FF
SHA-512:	CA8C6B60377706D4BBF6FFD1AEAB7BCE36350CC92E9E1EEF0F7C1096A435745CB96E2518CC99DD03859CA2377B434A6D443054C30A7E563E0B6DAE8E7470CBAD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d....B.f.........." ..... ..........P.....................................................`..........................................8......`9..d....`.......P..X............p..(....1...............................1..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.10501678535697
Encrypted:	false
SSDEEP:	192:lF/1n7Guqaj0kt7/Ev9kt0Qwac6QzD+iD0QocqgI4G0S:RGXkd/EvGt9wacNDJAgI4v
MD5:	3CF2B33DB41381691EF10E43AC6D9C74
SHA1:	F6EFDF5534BA86A8EF47B6499D85F618CEB93824
SHA-256:	C0FC3EB011753C30C79A6AA6982BF764174449E12BFEEACF475E42249EFAA218
SHA-512:	C47B5BF98798770029A49ABC1249916C5CB76119C0EF31E770D82813D084A57292B087133EE1CF025DF9A977B647A48EDDFAE2246E045CB2ACBCC71ACD57134A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d....B.f.........." ......... ......P.....................................................`..........................................9.......:..d....`.......P...............p..(...@3..............................`3..8............0...............................text...H........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.67112951018799
Encrypted:	false
SSDEEP:	384:DPHoDUntQj0sKhDOJ+0QPSfu6rofDciZzgE+kbwb:mUOYsKNO466DcoUE+
MD5:	2EFA942A436CA17562FB49BB66ACDCC4
SHA1:	50B2841914E9A1237AC29C7A681F0951C03D59A4
SHA-256:	4810A6392848B3FF20D67A531A26DAAF2E1F2FE37CF61C0245D24CB0FA00177D
SHA-512:	BAD96C34D318B975330F720B422C758DDC91AE6AB34B873F9A68F060F52552939654AC7A78D49EA787D7F182E293C604F772BEA9E027D0159A43C9F06957D392
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h..9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d....B.f.........." ...............P.....................................................`..........................................H......hI..d....p.......`..X...............(....A...............................A..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.878788018845523
Encrypted:	false
SSDEEP:	384:VJWo4IRCGHX1KXqHGcvYHp5RYcARQOj4MSTjqgPmJD1O2gkxEv:VcIRnHX1P/YtswvaD1Qk
MD5:	5CB71342E09FAA10F9C4B55E56746DEB
SHA1:	E1F5F0225CE90F3FAC8A3BC7898A18F145A15317
SHA-256:	30EB7E9CB9ECC84A424864E20B01EBA47ECB7E8597A83244C35798A1AB75F2E3
SHA-512:	5E5A154FB41E969021974889B1D5B5D657464D9B3C94AABA6F3DF74424934DA9D02786B242A6781257BF148198CE352B1851E46612BBD4C112B6677DB874BD08
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d....B.f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.881719483503825
Encrypted:	false
SSDEEP:	384:mJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD1IgkxEv:mcIRnHXfP/YtswvaD1tk
MD5:	15E2C2434668D1648D9147156B0A44C6
SHA1:	BEA635ADFD889381CC324D2612606E409518261D
SHA-256:	EBEE833D40ED09ABCCFF1F415B4A4CB1EC6F8D84431067980B09A36450EDB9F8
SHA-512:	197818202B07F97DC370F456A1F59A5210C8AF7E8221D6E0BBF8A96E8190668DD29D353BFFB0F833FC622B8F797558708446CDDE7A062ECD8C66D67B87262445
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d....B.f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.837967098997982
Encrypted:	false
SSDEEP:	768:C839Cc4itui0gel9soFdkO66MlPGXmXcyYDTHks:Zs4u/FZ6nPxMLDzk
MD5:	BEF2C0DD6DFB0C99F49681520FAC9C29
SHA1:	A97FD9EBA05C3D5B14839A1BEFC34C72D407FD2D
SHA-256:	DD8B11D83208286EC46A4698EE57AA354BFA2B6EEBDD97245D49007304439884
SHA-512:	D5C1CE51A6AA8455987ED5FC7B6511B373569D71EB14662C1E452D5279D44FAB3AECE9CA763B41C34CA350F4C4E18F8378EA513091B348BD745490233C60338B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d....B.f.........." .....H..."......P.....................................................`..........................................k.......l..d...............................(...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.895432566171149
Encrypted:	false
SSDEEP:	768:4cX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTxvk:338u/FZ6nPxM3D9k
MD5:	D6D6E9C22ED2A06562D4D6D4A43F7FE7
SHA1:	773F848975F6ABA43618D65EC518FA9B62CD4DC1
SHA-256:	CF97616BF0CB1EEEC2906FE47CF219332EE697C43A2F2E4D0E67DA40360C1ADE
SHA-512:	B4C1F45A74B966FF1E047B0B0E429204CDA6E033B0923BCAF78959AE2974D71F6C6B25E598A4770C30EAE46738C90C3C455759EF63CE1867DC0229A167DD7256
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d....B.f.........." .....H..."......P.....................................................`.........................................@l......(m..d...............................(....d...............................e..8............`...............................text...hG.......H.................. ..`.rdata..x....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.967920497161766
Encrypted:	false
SSDEEP:	192:dUWt/1nCuqaL0kt7TsEx2fiTgDFqGF0T7cqgkLgJ:c/k1Ts64DDVyBgkLg
MD5:	26798493D96B2B2CB9601C0708595B84
SHA1:	CEC50F2D5D38E3410F1FFE1546A08BE35847B198
SHA-256:	84E5F449D863E2801C93C84648AB18C078FE52D75CE4309632AFC295081AB5E8
SHA-512:	3F8F3BB54CD0755CCCD4CF6E8ED29C2D0F1C10BAEB6A0E58D6DB51F5A5A442D653114EB2AC8EE78833E26F71275602F0B3B0E06C333B22BB45C1D2E7A70F278C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d....B.f.........." ................P.....................................................`.........................................P8.......8..d....`.......P...............p..(....1...............................1..8............0...............................text............................... ..`.rdata..2....0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.007946351080744
Encrypted:	false
SSDEEP:	192:gt/1nCuqaL0ktPH0T7fwtF4zDD2rGacqgRGd:N/kpU3Yv4zDLqgRGd
MD5:	BEA27CB11A8529D6AD11373531E5222F
SHA1:	74B61DA8FD39F03136B4FAD7FAA7E5A1EA7C1116
SHA-256:	1EB72BD49457080CE1432EB28E85134D7BD4344BCCD9357839ACBBFA9236B868
SHA-512:	49FEC85D5853DDB352ABC93BE6CAB3C42F2A3DBCDF32A90FE7FFF6E5BF378514C594328C7845F892508C8301F8224F7A6A26F44458A6A9EBC59D99B7CCEF8F4B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d....B.f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.22636430845807
Encrypted:	false
SSDEEP:	384:FfRKTN+HLjRskTdf4WazSTkwjEvuY2bylHDIYIgovg:YcHfRl5pauoSjy5DIE
MD5:	7F4AFB84A7F42103E1AD2FB97F01B924
SHA1:	19A74E979422911557F4E1A04ED8D1E64840B5CD
SHA-256:	FCB30E2A27EDD1410A6D7D2DE29DC194E70A5DC4F54B705E6BBA9E6E7AF411DD
SHA-512:	EF50B41D44FBC886CA27A1FB70EB9F7C7BFF2C659A90C893E1930C6525B39E1E40045176A57745EABC2E4503F353E65CC5D9C1899F25E5793EA26E353356AD5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d....B.f.........." ..... ... ......P.....................................................`..........................................9.......9..d....`.......P..X............p..(...p2...............................2..8............0...............................text............ .................. ..`.rdata..@....0.......$..............@..@.data........@.......4..............@....pdata..X....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..(....p.......<..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.261897747374345
Encrypted:	false
SSDEEP:	192:XZN2eq/b04PAHH41F6fnVS0sVn+5CA5Z1cDz6WGcqgFjLg:iI4IHHaQfSVnCZyDvmgFjLg
MD5:	F6388659B3203E6ACCF2B317382162B6
SHA1:	F3DBFF5935B069E9256A20B8B7B49AB203602C67
SHA-256:	07EF9E9C2D43342000E048AB8F4ECB92A9298B32AC1D2D0ACD90501350EDA7D5
SHA-512:	B2C2CE460D4F8F91AD4EF3C36D6E3B8E65BAA1B5F2B9A7BFDB4D400F0467BA1A4C827AD4A344F5C4A5DC0DA61AA226C8ABF27DBBFF8DC791F085C9F25F504471
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d....B.f.........." ................P.....................................................`..........................................8.......9..d....`.......P..\|............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..\|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Math\_modexp.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.913982056265063
Encrypted:	false
SSDEEP:	384:qspbXtHQY4ubrttQza9CHnZXQsnecAlOF0qZLAXxQI3Sya6XPpMg3Yx8MnDcCPSj:6Y44UagH6cAFCLUSYpMg3YDzPo5/G9G
MD5:	7376120CC8C5E3BA94CD453A464F96A2
SHA1:	E6D3D75AEBFE144EBD5D894BB54D1D272B76D92E
SHA-256:	D1AD22734319F91CC9D3002884C1EEA79107F4E2D2D21B0CBE22F33AE73E4DD1
SHA-512:	E02F2081E4BC87D572127DBBD97F1CB6933F37424B5FD5AC6F3149250BE5128525A9D92057E1C605990B710A6C2F20389D24F24569E14D51FDC2B4615D97D6BC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d....B.f.........." .....`...0......`.....................................................`..........................................~..\|...L...d...............<...............(....q...............................q..8............p..(............................text...X^.......`.................. ..`.rdata.......p.......d..............@..@.data................x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.735395385607169
Encrypted:	false
SSDEEP:	192:rcsC3eqv6b0q3OQ3rHu5bc64OhDXI/p3cqgONLg:rmHq3jHuY64OhDGJgONLg
MD5:	308C6E862A3554F1B5587D003F4B1BBF
SHA1:	800955D3A24065766E5825C8324B7F48CD02F073
SHA-256:	671AAD8B7FAE31E076DF50C947CD198369EEA6379E6FA1B058596E528F5DA561
SHA-512:	35B27A6320A8046F7E7BC42B9AF8414B076F5334467576A0E83C6D7992EC3675F73CF0FC72AE6DA402FF70DD16FCC0C29287AB27AD04BB346D5229D62DEB54A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d....B.f.........." ................P.....................................................`..........................................8..d....8..d....`.......P..4............p..(....1...............................1..8............0...............................text...H........................... ..`.rdata..0....0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_curve25519.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.7058009726968155
Encrypted:	false
SSDEEP:	384:b9BcRxBmau38CYIl9bhgIW0mvufueNr359/tjGGDmFSegqrA:TcRy38J+9dmvufFtaGDH
MD5:	63E585DC95B65FAE903369EFC94B35F4
SHA1:	F03B387DD3AAA943F84C4507B191FCF9FD1C5D2A
SHA-256:	DD3B3B23C388C4D6956C1572EA153DF62B02BA6AD7C5632D9254B0D091400E2E
SHA-512:	AFFA8FF13561ED69D47A873220B482E4AD09766338ECBF5E8A9DC4C5E95D22613BD5B70119218295096C5B54351AACE4A437173D5E99D8D000ADD726019D4DA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d....B.f.........." .....6...$......P.....................................................`.........................................`Y......`Z..d............p..................(....R..............................0R..8............P...............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......P..............@..@.rsrc................T..............@..@.reloc..(............V..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_curve448.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	6.019125929952969
Encrypted:	false
SSDEEP:	1536:+fju4GgRMgWWnEDZiECgd/iwOXUQdbhov0Clb8Cx4hpK8ithLFIDullRPwDHxXja:CXRMgWiEDZiECgd/iwOXUQdbhov0Clb1
MD5:	81EA717DAABBE21EA84BCA3E947C1557
SHA1:	B98EE93811A9A262E4197D13DDB78441A90CCBB3
SHA-256:	A12601F82A9C3C92552B1A80D310C7922ABE9A03BB58ACDB749216FA5EFC6D51
SHA-512:	126E7DFC828A39A37F72C989566FAF4E5E2842C46D47B77DC74E10D1E88ED5B7FB1011C93C13FF474F824EC8222A25305A55961408AD96EECBCD3A57D2EAB721
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d....B.f.........." .........8......`........................................P............`.............................................0.......d....0....... ..$............@..(.......................................8............................................text...8........................... ..`.rdata..............................@..@.data...............................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770560
Entropy (8bit):	7.613225426906836
Encrypted:	false
SSDEEP:	12288:WtIrHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:WtIrHoxJFf1p34hcrn5Go9yQO6
MD5:	6E423574D805A2A8D0FCF599B3DB13E8
SHA1:	551D39DCC40A2049B7668DFF28A61949AB23C11A
SHA-256:	4372D02096FEB267F131F35644E902E19FB4BA6CE6CBDEF5E42D06BA78C0C74F
SHA-512:	67CF163D73C7E81ECCEE9F00ED698BA9C3DD2CBB3F7F5E81C740210ED37773F6820879F1BE528B5AC3D16969895EF18293BE194860C34CFED527065EBF966BDA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d....B.f.........." ................`.....................................................`.............................................h.......d...............................0......................................8...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.855495726605704
Encrypted:	false
SSDEEP:	384:2czadRwoF2MZ81n0XTyMCYIl9bhgIW0mv8aeadRcwRwftjGLD2aRQNgQQ77k:vudRf2MuMJ+9dmv8aea34taLDDfQ
MD5:	6B1383F534E7DAFB5C02F126AB34CE06
SHA1:	4D00AE8BBB2B2EB7618CFA8854E99EE359F73556
SHA-256:	D620E2F1FB049A5B8094E47F3CB2D790E11D9FEC68939323727D5ED52BF93170
SHA-512:	724496B47EA52AAF1E3D2A8F00BCA4948DB36F32F29950A4DDE96D53DA12AAD61FDF53DB9E97DB8676A5C52499BE912F2AB0F47D9FC2764DB5F2FCECC1329612
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d....B.f.........." .....B...&......P.....................................................`..........................................i..0....k..d...............................(... b..............................@b..8............`...............................text....A.......B.................. ..`.rdata..P....`.......F..............@..@.data........p.......V..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	6.064765416588426
Encrypted:	false
SSDEEP:	1536:/rYNvxcZeLrIeNs2qkTwe57DsuP45PqAqVDK9agdUiwOXyQdDrov0slb8gx4TBKk:/r4vxcZeLrIeN1TvHsuP45yAqVDK9agR
MD5:	11B6F5FD2BDB4F885D9A46E8F3424AC8
SHA1:	E019D39543FCB9C25179CC73D79877749D7ADD7E
SHA-256:	1B392561C21E555E78CEF0F823C682E2892C751FE7DA51C3137BAA87B2EE5223
SHA-512:	6C3A9751656FEA10A690DEC29130B910E8ADD7CC6B547A053E1FBA64604F768D5719258AA96E49CA08669080ADA64FF668F7135D458906E7B58C4473F45AF098
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d....B.f.........." .........8......`.....................................................`..........................................C..h...HE..d....p.......`..l...............(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata..l....`.......>..............@..@.rsrc........p.......H..............@..@.reloc..(............J..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.67646605814196
Encrypted:	false
SSDEEP:	96:f0QRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDeqf4AZaRcX6gnO:5ddz2KTnThIz0qfteRIDxRWcqgnCWt
MD5:	690FC8D8423EE69C662F11CD6406CEF1
SHA1:	A0B78AF3BC976C8AAFA1FE80EF71F22D4BF7080B
SHA-256:	BD597E5853A3F2CAD1D4E5743170A66383BE18D215F8F83BE2A473736EE28718
SHA-512:	B08DD641AEF8C663174C4AD436915FFC4C4AFB70B8A9719F535F1F99B7B29240A0C8951E19F3348C010DAD3000B6B5173B1DEF077EC6D96BB8A3D3E9BE339A40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d....B.f.........." ................P........................................p............`.........................................@'..\|....'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Util\_strxor.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.625951827424241
Encrypted:	false
SSDEEP:	96:fyipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDeZqYNIfcX6gHCWx:Hddz2KTnThIz0qfteR5DewYkcqgHCWt
MD5:	174B652C8E6C40C36C8AB06A20A34C01
SHA1:	F3CB9321100DCE3A8D79B0FC517CC58E05D26E41
SHA-256:	42AF8D99FC975720585D25D767FC825D4922C088B6C2B13EE2DE23E439523610
SHA-512:	9F0C444069E477A043C85F606BF1A3FB695773DBC16D1124A4B2D771EA0385B797552031433CB625D7DC9C8D490EB0EF8FA2C13AA628EBBA58DF6A0530913F32
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d....B.f.........." ................P........................................p............`......................................... '..t....'..P....P.......@...............`..(....!...............................!..8............ ...............................text...h........................... ..`.rdata..`.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imaging.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2343424
Entropy (8bit):	6.507291548306534
Encrypted:	false
SSDEEP:	24576:11/7+Ny6imt6M5BRI+kDx1y0IQphHAokIEEKfMbrE8EPsoU0eJct/jVM5HFd5:11/7w95ctyTQHAjIEx2EPsoU0Lto7
MD5:	45ED5B175FF3FEB7D39F8482C5E60848
SHA1:	C0EB6EF9978FA1A62FFE8403870475B22DE3C7E7
SHA-256:	FFADC62922AAC7F93D4EC6F2EB41CD836104F88D86B45E9FC295087FAD7D262E
SHA-512:	69E24B20822B413EE3C7A5FFBD60F41AFB420E4BAC45DABEF31CCB2C9C3F9DC50B48E01E5C870B3367208F3A85FCEAF51F052C0B3ADF2B7A7F209A9532E36BEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$...$...$...-.o.4....`..&....`.. ....`.. ....`..,....`..*...7g..&...o...#...$...,...$...?...7g......7g..n...7g..%...7g..%...7g..%...Rich$...........PE..d..._J.f.........." ...(.2...................................................@$...........`.........................................0F".`....F".......$.......#.h............ $.....0. ....................... .(..... .@............P..(............................text....1.......2.................. ..`.rdata..$....P.......6..............@..@.data........p"..b...J".............@....pdata..h.....#.......".............@..@.rsrc.........$.......#.............@..@.reloc....... $.......#.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imagingcms.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	262656
Entropy (8bit):	6.282156679924657
Encrypted:	false
SSDEEP:	6144:gXnnqhP8Sq5V6SuRI7OzhHTnLg9uP1+74/LgHmPr9qvZqhLaHLTLrLfqeqwLii66:gXnIPE5GhHTnLg9uP1+74/LgHmPr9qvG
MD5:	30CEC332935A3E27B399A0939BDBECD7
SHA1:	3FDB19380F95B3299C0C0CAC4D8F21EDFC14C368
SHA-256:	91D0D471C50CFCC9FD8688AE2350477408BB987E67A1C5F508D17C5DD021314F
SHA-512:	091B3FE2F4F4FA6FCAE8F920D9F97089CDB9DB8E57980588198873D07E12C994CBC860B02597BD128862E475AE0C54A283D6DBC194F1F2D3978BA77F7D39965B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.}..s...s...s.......s.......s.......s.......s.......s.......s..J....s...s..ms.......s.......s.......s.......s..Rich.s..................PE..d...OJ.f.........." ...(..... ...............................................@............`.........................................@...h............ ..........\|/...........0.......`..............................._..@...............`............................text............................... ..`.rdata.............................@..@.data....>.......:..................@....pdata..\|/.......0..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imagingmath.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.671576218459356
Encrypted:	false
SSDEEP:	384:Bl6YwU58iEr4Pp/zosXH1UXAN+I6kIbHOKZHMxgaUJ:Bl6Yp8jrszoE1UXvTHOCHM6a
MD5:	D80E23C523BEA5ACA6EC702EF6DCBF8D
SHA1:	A363362E722B68AAEA9BA30965AF18AAB505BFE1
SHA-256:	C480EDC4EBD5757B92F543B0589AF0C6FEBF1153992B948322B7E69F2A0EAF61
SHA-512:	D1381B1B929DCDBDFF8AEF1D09E05E7DF8F31E8A6C2CB89015B343FE963CA04AFB448E84436C4A04A5EF704FAADBF290AD1780D28F940FAE11D06359F66553F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........B...B...B...K...F....t..@.......@....t..A....t..J....t..N...Qs..A...B...m...Qs..C...Qs..C...Qso.C...Qs..C...RichB...........PE..d...PJ.f.........." ...(.6...*......@9....................................................`.........................................@`..h....`..x...............8...............@....U...............................S..@............P..`............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data...P....p.......P..............@....pdata..8............R..............@..@.rsrc................Z..............@..@.reloc..@............\..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_imagingtk.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.083733997082165
Encrypted:	false
SSDEEP:	192:sGrzuJtIEepKl1Cxmnyx1ttkobpsE0BDAXR09IckgTd2T:puJgp6Dy7XDbpsEiAXG9GgTd2
MD5:	6469B7315A33774D1C7EF7459058F889
SHA1:	FF37C958770C2BA3897D168A4AFBFFAD93E5E3BA
SHA-256:	317E4219DE122F058C86F858F11B9510B6D196FD8027DD35352E7784E6968500
SHA-512:	F56EA8983DA251908F7830A42EA57FEE1C6CD18EF00238693E108A9E58A560690769F69BBD639D2E5F239051012ACC17BC556CF3F5A09962B51ACE476FF471A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>.mm.mm.mm...m.mm.9ll.mm.9nl.mm.9il.mm.9hl.mm.>ll.mm..ll.mm.lm.mm.>el.mm.>ml.mm.>.m.mm.>ol.mmRich.mm................PE..d...PJ.f.........." ...(.....$......@.....................................................`..........................................;..d...$<.......p.......`..................<...`5.............................. 4..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data...X....P.......0..............@....pdata.......`.......2..............@..@.rsrc........p.......6..............@..@.reloc..<............8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\PIL\_webp.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	412160
Entropy (8bit):	6.5323629884961605
Encrypted:	false
SSDEEP:	6144:Tt4e4UJ0STq5yCQCGNmwNby50erYs2uhCKeg09wd:TtZT6SGwCrxsOrYQe
MD5:	C09A7A8EA25DDC38DC498806EAAAE8E4
SHA1:	9E96616D04B6E02EB5018A63A35069ED8C1FFF98
SHA-256:	78896672E2CD8346717F06EFED551347B3158DC10AAEC2FC61071C1791C06437
SHA-512:	2AD92553AFB5C40844AC66466E043750D8FC5E324B8700D518068F638C0AE7B9C963CA9D22F91FD5A462C6718FF742E3CFD2BF7E3658437C73935719AA8FEEB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|.k...k...k.......k..]....k.......k..]....k..]....k..]....k.......k...k...k.......k.......k.......k.....k.......k..Rich.k..........................PE..d...OJ.f.........." ...(.....\............................................................`.........................................0...\....................`...<..................p...............................0...@............0...............................text...(........................... ..`.rdata.......0......................@..@.data....2... ......................@....pdata...<...`...>..................@..@.rsrc................F..............@..@.reloc...............H..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.701724666218339
Encrypted:	false
SSDEEP:	768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
MD5:	68156F41AE9A04D89BB6625A5CD222D4
SHA1:	3BE29D5C53808186EBA3A024BE377EE6F267C983
SHA-256:	82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
SHA-512:	F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......\|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71448
Entropy (8bit):	6.274367479203647
Encrypted:	false
SSDEEP:	1536:zF44laLwm4HS8NywUlz4dIvOnW7Sy85x4:zO4eBCxNywWEdIvOnWaA
MD5:	E74E8B37BD359F581F368BA092EED90E
SHA1:	E6BDC3494DBC5D4AE0434BF4DC3B2952E4827F18
SHA-256:	184FC13677C7856E7A8B31DFE79CE68DCEA10CDF83A205DE2B0D5497FB0FFDF3
SHA-512:	29D33593758945A02844E1333ED99D66A0E42EB7E8D0C881197F05D4EC9DAD3F1BB490739BC2D64EA9451F4BBBFCC05089A57A7AA1EC22C4091C7EDD604B7F7C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z...........%.....................................................K...................I...........Rich...................PE..d....g.f.........." ...).f................................................... ......HM....`.............................................P......d......................../..............T...........................P...@...............(............................text....e.......f.................. ..`.rdata...O.......P...j..............@..@.data...p...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84760
Entropy (8bit):	6.5949173382940405
Encrypted:	false
SSDEEP:	1536:ZWNz7JrA+VLsS53XtGHagwIF27YuLw8emTayR12FIvCVv7Sy+xJ:0Nzdb53XfoxKrbTBkFIvCVv4
MD5:	FE499B0A9F7F361FA705E7C81E1011FA
SHA1:	CC1C98754C6DAB53F5831B05B4DF6635AD3F856D
SHA-256:	160B5218C2035CCCBAAB9DC4CA26D099F433DCB86DBBD96425C933DC796090DF
SHA-512:	60520C5EB5CCC72AE2A4C0F06C8447D9E9922C5F9F1F195757362FC47651ADCC1CDBFEF193AE4FEC7D7C1A47CF1D9756BD820BE996AE145F0FBBBFBA327C5742
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!...!...!...(.o.+...1I..#...1I.."...1I..%...1I..)...1I..,...iH.."...j...#...!...~...iH..)...iH.. ...iH.. ...iH.. ...Rich!...........PE..d....g.f.........." ...).....^......`........................................P............`.........................................0...H...x........0....... ..,......../...@..........T...........................p...@............................................text............................... ..`.rdata...>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\_cffi_backend.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	179712
Entropy (8bit):	6.180800197956408
Encrypted:	false
SSDEEP:	3072:IULjhBCx8qImKrUltSfGzdMcbb9CF8OS7jkSTLkKWlgeml:IgCeqImzSfIMcNCvOkSTLLWWem
MD5:	FCB71CE882F99EC085D5875E1228BDC1
SHA1:	763D9AFA909C15FEA8E016D321F32856EC722094
SHA-256:	86F136553BA301C70E7BADA8416B77EB4A07F76CCB02F7D73C2999A38FA5FA5B
SHA-512:	4A0E98AB450453FD930EDC04F0F30976ABB9214B693DB4B6742D784247FB062C57FAFAFB51EB04B7B4230039AB3B07D2FFD3454D6E261811F34749F2E35F04D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......a..#%p.p%p.p%p.p,..p)p.p5.q'p.p5.zp!p.p5.q!p.p5.q-p.p5.q)p.pn..q!p.p6.q&p.p%p.p.p.pm..q!p.p,..p$p.pm..q$p.pm.xp$p.pm..q$p.pRich%p.p........................PE..d...W..f.........." ...).....B......`........................................0............`..........................................h..l....i..................T............ .......O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...p..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	125208
Entropy (8bit):	6.136121476280913
Encrypted:	false
SSDEEP:	3072:4LIBXrBDuYifTbergyzjsckxf/EfCODh1NlL5IvLPJjL:XBbBDuBf2HfUxf/EfBDn0
MD5:	302DDF5F83B5887AB9C4B8CC4E40B7A6
SHA1:	0AA06AF65D072EB835C8D714D0F0733DC2F47E20
SHA-256:	8250B4C102ABD1DBA49FC5B52030CAA93CA34E00B86CEE6547CC0A7F22326807
SHA-512:	5DDC2488FA192D8B662771C698A63FAAF109862C8A4DD0DF10FB113AEF839D012DF58346A87178AFF9A1B369F82D8AE7819CEF4AAD542D8BD3F91327FEACE596
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f~.............................................................................){.............................................Rich............PE..d....g.f.........." ...)............P_....................................................`.........................................``.......`.........................../......t.......T...............................@............................................text............................... ..`.rdata..zl.......n..................@..@.data...,5.......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	256792
Entropy (8bit):	6.572286948518575
Encrypted:	false
SSDEEP:	6144:hJ1fsF1yTr4Q6Vll9INhWyZHV89Ilxe99qWM53pLW1AdZZZEgtLMwDrijc:VvUVlEhBX2YcQaAnDOY
MD5:	82321FB8245333842E1C31F874329170
SHA1:	81ABB1D3D5C55DB53E8ACA9BDF74F2DEC0ABA1A3
SHA-256:	B7F9603F98EF232A2C5BCE7001D842C01D76ED35171AFBD898E6D17FACF38B56
SHA-512:	0CF932EE0D1242EA9377D054ADCD71FDD7EC335ABBAC865E82987E3979E24CEAD6939CCA19DA63A08E08AC64FACE16950EDCE7918E02BFC7710F09645FD2FA19
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J6U.+X..+X..+X..S...+X..Y..+X..[..+X..\..+X..]..+X...Y..+X..SY..+X..+Y.E+X...[..+X...U..+X...X..+X......+X...Z..+X.Rich.+X.................PE..d....g.f.........." ...).....:............................................................`.........................................@c..P....c..................d&......./......T.......T...............................@............................................text............................... ..`.rdata..............................@..@.data...X*.......$...`..............@....pdata..d&.......(..................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66328
Entropy (8bit):	6.229205873282761
Encrypted:	false
SSDEEP:	768:mHhSlKxOZdShtmgHbGmZOEoSK3Ic0V3QBdIvOI25YiSyv/AMxkEU:CxO3I17DZRoh3Ic43WdIvOIM7Sy3xg
MD5:	0ABFEE1DB6C16E8DDAFF12CD3E86475B
SHA1:	B2DDA9635EDE4F2841912CC50CB3AE67EEA89FE7
SHA-256:	B4CEC162B985D34AB768F66E8FA41ED28DC2F273FDE6670EEACE1D695789B137
SHA-512:	0A5CAE4E3442AF1D62B65E8BF91E0F2A61563C2B971BBF008BFB2DE0F038EE472E7BFCC88663DC503B2712E92E6A7E6A5F518DDAB1FAB2EB435D387B740D2D44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........WH@.6&..6&..6&..N...6&...'..6&...%..6&..."..6&...#..6&...'..6&..N'..6&...'..6&..6'.16&...+..6&...&..6&......6&...$..6&.Rich.6&.........................PE..d....g.f.........." ...).V..........0@....................................................`.........................................p...P................................/......X...@}..T............................\|..@............p..(............................text....T.......V.................. ..`.rdata...O...p...P...Z..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158488
Entropy (8bit):	6.857717041623552
Encrypted:	false
SSDEEP:	3072:kf7P77jrFDn7NjQDRX17znfV9mNoHnIjN1VbHNiFIvZ1AB:kf7j9OD9YOH+bHNiJ
MD5:	E3E7E99B3C2EA56065740B69F1A0BC12
SHA1:	79FA083D6E75A18E8B1E81F612ACB92D35BB2AEA
SHA-256:	B095FA2EAC97496B515031FBEA5737988B18DEEE86A11F2784F5A551732DDC0C
SHA-512:	35CBC30B1CCDC4F5CC9560FC0149373CCD9399EB9297E61D52E6662BB8C56C6A7569D8CFAD85AEB057C10558C9352AE086C0467F684FDCF72A137EADF563A909
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,..:,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..V,.V.,..-.V.,Rich.V.,........PE..d....g.f.........." ...).`..........`2..............................................HP....`.............................................L...<...x....`.......@.......<.../...p..4....\|..T............................{..@............p...............................text...f_.......`.................. ..`.rdata.......p.......d..............@..@.data...p....0......................@....pdata.......@......................@..@.rsrc........`.......0..............@..@.reloc..4....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35608
Entropy (8bit):	6.431265882453482
Encrypted:	false
SSDEEP:	768:CI9pp7OBajKCD2yil0uduNIvWtR5YiSyv/7AMxkEsR:CoptOBaJDil0uINIvWtf7SyLxC
MD5:	4DAA82AAFC49DD75DAEA468CC37EF4B0
SHA1:	CBF05ABC0EB9A6529AA01955D5FEAC200E602C89
SHA-256:	A197F3485BBE30B3A1612EA2198CEF121AF440BA799FD6CBF0AD3493150DF3CA
SHA-512:	473CAA70EC832B645296EBA3DA2DC0BBFC90DF15281A9DE612A2FEBF10B7E86D7F20F1C265C7BE693BC0D25E11D3D2904F4C2B1039A81AE0E192CFCA625408D5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.W)v.9zv.9zv.9z..zt.9zf,8{t.9zf,:{u.9zf,={~.9zf,<{{.9z>-8{t.9zv.8z..9z=.8{s.9z>-4{t.9z>-9{w.9z>-.zw.9z>-;{w.9zRichv.9z................PE..d....g.f.........." ...). ...>......@...............................................&.....`.........................................@E..`....E..x............p.......\.../...........4..T............................3..@............0...............................text............ .................. ..`.rdata... ...0..."...$..............@..@.data...`....`.......F..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56088
Entropy (8bit):	6.331887829832768
Encrypted:	false
SSDEEP:	1536:+5i+rYIgKZPXZCJ/+SdwDDrxIvXtF7SySxP4:+50J/+SdwDDrxIvXtFy4
MD5:	B89FCA6EDBA418768147E455085F7CC7
SHA1:	5D41E0990E19EE0D131B4FE8C6AC5B7371D1F83E
SHA-256:	2AF91C5AB6F05C4BE357B93673920ECCF3EBCAD5E5EC6B0A7B53EF94A5FEAAD7
SHA-512:	A6BD8D62FB1FBEBBFA9FEE9037EFFBCBBB48BFA2E6C8B398E036C0BD5F402A4B1C0BF0AD8D80585FE501E00D7FE21B387A0F0E05AD2FCDF3AEB248010CB3F1BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.{X/.(X/.(X/.(QW_(\/.(H..)Z/.(H..)[/.(H..)P/.(H..)T/.(...)Z/.(X/.(//.(.W.)]/.(.W.)Y/.(...)Y/.(...)Y/.(..3(Y/.(...)Y/.(RichX/.(........................PE..d....g.f.........." ...).N...`.......................................................8....`.............................................X.............................../......(....f..T............................e..@............`...............................text...7L.......N.................. ..`.rdata...8...`...:...R..............@..@.data...0...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32536
Entropy (8bit):	6.553393437193411
Encrypted:	false
SSDEEP:	768:g1zRmezk6rGq17W45IvQUcV5YiSyvRfAMxkE4:QRm0lGY7W45IvQUc77SyhxM
MD5:	941A3757931719DD40898D88D04690CB
SHA1:	177EDE06A3669389512BFC8A9B282D918257BF8B
SHA-256:	BBE7736CAED8C17C97E2B156F686521A788C25F2004AAE34AB0C282C24D57DA7
SHA-512:	7CFBA5C69695C492BF967018B3827073B0C2797B24E1BD43B814FBBB39D1A8B32A2D7EF240E86046E4E07AA06F7266A31B5512D04D98A0D2D3736630C044546E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\...........%.........................................................................I...........Rich...................PE..d....g.f.........." ...).....8............................................................`..........................................C..L...<D..d....p.......`.......P.../...........4..T...........................@3..@............0..8............................text............................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83736
Entropy (8bit):	6.318116609837273
Encrypted:	false
SSDEEP:	1536:3OYxHEUZql2HLSyypHb9/s+S+pzG8iFWmIHJqKN5IvLw767SyZxqND:+dUZqzyypHb9/sT+pzG8CxIpdN5IvLwD
MD5:	632336EEEAD53CFAD22EB57F795D5657
SHA1:	62F5F73D21B86CD3B73B68E5FAEC032618196745
SHA-256:	CE3090FFF8575B21287DF5FC69AE98806646FC302EEFADF85E369AD3DEBAD92B
SHA-512:	77965B45060545E210CDB044F25E5FD68D6A9150CAF1CAD7645DBAFCF1CE8E1CCBDF8436FBDCBF5F9C293321C8916E114DE30ED8897C7DB72DF7F8D1F98DFB55
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...Ml}.Ml}.Ml}.5.}.Ml}..m\|.Ml}..o\|.Ml}..h\|.Ml}..i\|.Ml}..m\|.Ml}.Mm}.Ml}.5m\|.Ml}..a\|.Ml}..l\|.Ml}..}.Ml}..n\|.Ml}Rich.Ml}................PE..d....g.f.........." ...).x..........0-.......................................`......75....`.........................................@...P............@.......0.........../...P......P...T...............................@............................................text....v.......x.................. ..`.rdata...x.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	125208
Entropy (8bit):	6.254951172698308
Encrypted:	false
SSDEEP:	3072:pNjpEptGwf/pPCO4w5y39lRnN7zLJyedIvOQVJ:pN/C5alz7PJyeA
MD5:	D3D748770F9BBCF22F20322250BEFD5B
SHA1:	0B5CED1DE5F6585CFD3EDD9D00F75E56D2C0959D
SHA-256:	FEF8E9F427B47E7758658A876FF1F2D718119AF54DBB0498E14C8234571942DF
SHA-512:	C8027EB9A71C5AAF9D714BFEBEBAD091ED45952CA2867981FD1A4E1FDB9FA409ADDFBCB1D2DC01732A2216B257300D6A88AAEA0742B6E1B1D1ABBAC5506FEABC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V^.70..70..70..O...70...1..70.....70...3..70...4..70...5..70..1..70..O1..70..71..60..=..70..0..70....70..2..70.Rich.70.........................PE..d....g.f.........." ...)............@...............................................\.....`......................................... o..P...po..................D......../.......... ...T...............................@............................................text...<........................... ..`.rdata..B...........................@..@.data................~..............@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	177944
Entropy (8bit):	5.9708659528965855
Encrypted:	false
SSDEEP:	3072:V1l+KugCpMRjN/ft6X6k7GxOnvvkKuFBZd4rYcvsswCfyX0NoFFIvC75/:V1QKugCpAJHt6X6nKvv9gF5
MD5:	EEA3E12970E28545A964A95DA7E84E0B
SHA1:	C3CCAC86975F2704DABC1FFC3918E81FEB3B9AC1
SHA-256:	61F00B0543464BBA61E0BD1128118326C9BD0CDC592854DD1A31C3D6D8DF2B83
SHA-512:	9BD5C83E7E0AB24D6BE40A31AC469A0D9B4621A2A279A5F3AB2FC6401A08C54AEC421BC9461AED533A0211D7DBDA0C264C5F05AEB39138403DA25C8CDA0339E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I.^.(k..(k..(k..P...(k...j..(k...h..(k...o..(k...n..(k..j..(k...j..(k..(j..)k..Pj..(k..f..(k..k..(k.....(k..i..(k.Rich.(k.........PE..d....g.f.........." ...).............,...................................................`.............................................d...T...................D......../......x...p...T...........................0...@............................................text...D........................... ..`.rdata..x".......$..................@..@.data...p...........................@....pdata..D............`..............@..@.rsrc................l..............@..@.reloc..x............v..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25880
Entropy (8bit):	6.594737327959795
Encrypted:	false
SSDEEP:	384:BxIQyiAWFIvZw2bHQIYiSy1pCQB+J8AM+o/8E9VF0Nylxr:cQy3WFIvZwm5YiSyvB3AMxkEFr
MD5:	48C6CCA2FDC2EC83FA0771D92BF1D72F
SHA1:	723A8BB6E715616DA003D7C658CF94FB129CD091
SHA-256:	869361ADF2BE930E5C8B492FA2116DC0D0EDCCBF2C231D39C859CE320BE27B31
SHA-512:	42FDCA831E8398638C06CD54186C63CB434DA78234A23D80E0F400C64D4E0E4EF8FA307D115B3775B4F97248BD3CE498D764C6BEFE11B078EC9FCDD270E8F324
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........p..#..#..#..\#..#..."..#..."..#..."..#..."..#..."..#..."..#..#...#..."..#..."..#..0#..#..."..#Rich..#........PE..d....g.f.........." ...).....&............................................................`.........................................p9..L....9..x....`.......P.......6.../...p..@...`3..T........................... 2..@............0..8............................text...h........................... ..`.rdata.......0......................@..@.data...`....@.......&..............@....pdata.......P.......(..............@..@.rsrc........`.......*..............@..@.reloc..@....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38168
Entropy (8bit):	6.338968434676258
Encrypted:	false
SSDEEP:	768:kEkKWSx+lZb+7iNEpPlFIvCiS5YiSyvxPAMxkERJ:kE9W5XyiNEvFIvCiQ7SyJPxj
MD5:	FDA7D7AADA1D15CAB2ADD2F4BD2E59A1
SHA1:	7E61473F2AD5E061EF59105BF4255DBE7DB5117A
SHA-256:	B0ED1C62B73B291A1B57E3D8882CC269B2FCBB1253F2947DA18D9036E0C985D9
SHA-512:	95C2934A75507EA2D8C817DA7E76EE7567EC29A52018AEF195FAC779B7FFB440C27722D162F8E416B6EF5D3FD0936C71A55776233293B3DD0124D51118A2B628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d....g.f.........." ...).,...<.......)..............................................Y.....`.........................................0V..H...xV.......................f.../......t...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..t............d..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\base_library.zip

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1332793
Entropy (8bit):	5.5865879348515195
Encrypted:	false
SSDEEP:	12288:f8lJGUqc4rmn9OPNsxuy4htMHc1b4oDAs/SquRROzBMdmyP/H/V949/Rr2/Hg:f8lJGUU697ls30yMdmyPvP4t2/Hg
MD5:	BED03063E08A571088685625544CE144
SHA1:	56519A1B60314EC43F3AF0C5268ECC4647239BA3
SHA-256:	0D960743DBF746817B61FF7DD1C8C99B4F8C915DE26946BE56118CD6BEDAEBDC
SHA-512:	C136E16DB86F94B007DB42A9BF485A7C255DCC2843B40337E8F22A67028117F5BD5D48F7C1034D7446BB45EA16E530F1216D22740DDB7FAB5B39CC33D4C6D995
Malicious:	false
Preview:	PK..........!....uS...S......._collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI59722\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI59722\charset_normalizer\md.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.674392865869017
Encrypted:	false
SSDEEP:	96:KGUmje72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFXiHBpv9cX6gTim1qeSC:rjQ2HzzU2bRYoe1HH9cqgTimoe
MD5:	D9E0217A89D9B9D1D778F7E197E0C191
SHA1:	EC692661FCC0B89E0C3BDE1773A6168D285B4F0D
SHA-256:	ECF12E2C0A00C0ED4E2343EA956D78EED55E5A36BA49773633B2DFE7B04335C0
SHA-512:	3B788AC88C1F2D682C1721C61D223A529697C7E43280686B914467B3B39E7D6DEBAFF4C0E2F42E9DDDB28B522F37CB5A3011E91C66D911609C63509F9228133D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..............................M....................................... ...?.......?.......?.a.....?.......Rich............................PE..d....jAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	5.917175475547778
Encrypted:	false
SSDEEP:	3072:bA3W6Fck6/g5DzNa4cMy/dzpd1dhdMdJGFEr6/vD:MW6NzcMy/d13FErgvD
MD5:	BF9A9DA1CF3C98346002648C3EAE6DCF
SHA1:	DB16C09FDC1722631A7A9C465BFE173D94EB5D8B
SHA-256:	4107B1D6F11D842074A9F21323290BBE97E8EED4AA778FBC348EE09CC4FA4637
SHA-512:	7371407D12E632FC8FB031393838D36E6A1FE1E978CED36FF750D84E183CDE6DD20F75074F4597742C9F8D6F87AF12794C589D596A81B920C6C62EE2BA2E5654
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..r...r...r......r...s...r...s...r...w...r...v..r...q...r.#.s...r...s...r..8z...r..8r...r..8....r..8p...r.Rich..r.........................PE..d....jAe.........." ...%.:...........<.......................................0............`.........................................@...d.......................(............ ......P...................................@............P...............................text....8.......:.................. ..`.rdata...W...P...X...>..............@..@.data...8=.......0..................@....pdata..(...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography-43.0.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography-43.0.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	5.074342830021076
Encrypted:	false
SSDEEP:	96:DlaQIUQIhQIKQILbQIRIaMPktjaVxsxA2TtLDmplH7dwnqTIvrUmA0JQTQCQx5KN:LcPuP1srTtLDmplH7JTIvYX0JQTQ9x54
MD5:	554DC6138FDBF98B7F1EDFE207AF3D67
SHA1:	B6C806E2AFF9A0F560916A90F793348DBF0514BA
SHA-256:	0064A9B5FD2AC18605E512EF7127318AD9CF259E9445488C169F237A590602E1
SHA-512:	3A71B533874F4D0F94F15192791D2FA4DF9E8EBF184C711F1D4FA97230C04764C1C9A93258355B08107E5B72053C6901E883E3DB577E8A204D5B9EB3F8BC7BFC
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 43.0.1.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography-43.0.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15485
Entropy (8bit):	5.562898568772727
Encrypted:	false
SSDEEP:	192:bXsToLbz5jF4E9VqhXJZ4WPB6s7B0Ppz+NX6in5Lqw/I+B:bX3LbhCEsJrPB6s7B0Ppz+96innVB
MD5:	D7262B007B918409832A311B9091308F
SHA1:	6E580D68591D640883C39F169804DACE34BEBF1B
SHA-256:	A4F1E0D2521FE6F9F028E820C1A59A0C0568B0C7ADD480E9793A75752795A197
SHA-512:	3FF07405E0D5B5AF123ECE0B72315C995B1E7AE62246FFA170FFB4276FC09F1DEFC8FEA79E84B8DE06D53D21926E0459F52B8837B093907A2C981CD9BF15F6D2
Malicious:	false
Preview:	cryptography-43.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.1.dist-info/METADATA,sha256=AGSptf0qwYYF5RLvcScxitnPJZ6URUiMFp8jelkGAuE,5440..cryptography-43.0.1.dist-info/RECORD,,..cryptography-43.0.1.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.1.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.1.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.1.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=pY_pmYXjJTK-LjfCu7ot0NMj0QC2dkD1dCPyV8QjISM,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-312.pyc,,..cryptography/__pycache__/__init__.cpython-312.pyc,,..cryptography/__pycache__/exceptions.cpython-312.pyc,,..cryptography/__p

C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography-43.0.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.016084900984752
Encrypted:	false
SSDEEP:	3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
MD5:	C869D30012A100ADEB75860F3810C8C9
SHA1:	42FD5CFA75566E8A9525E087A2018E8666ED22CB
SHA-256:	F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
SHA-512:	B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography-43.0.1.dist-info\license_files\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography-43.0.1.dist-info\license_files\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography-43.0.1.dist-info\license_files\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI59722\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7900672
Entropy (8bit):	6.519460416205842
Encrypted:	false
SSDEEP:	49152:Hvisa2OcIo0UYN1YA2sBCT7I0XIU6iOGtlqNVwASO0AIjoI+b0vjemXSKSDhxlT3:Pi/2PTYDBCT7NY+gTNxY7GbdJ295x
MD5:	81AD4F91BB10900E3E2E8EAF917F42C9
SHA1:	840F7AEF02CDA6672F0E3FC7A8D57F213DDD1DC6
SHA-256:	5F20D6CEC04685075781996A9F54A78DC44AB8E39EB5A2BCF3234E36BEF4B190
SHA-512:	11CD299D6812CDF6F0A74BA86EB44E9904CE4106167EBD6E0B81F60A5FCD04236CEF5CFF81E51ED391F5156430663056393DC07353C4A70A88024194768FFE9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..(...(...(...!...:...8......8...,...8... ...8...9...c..&...G......(...+...`...V...(.....`...)...`...)...Rich(...........................PE..d....j.f.........." ...).`Z..V........X.......................................x...........`.........................................p.r.......r...............t...............x......Cj.T....................Cj.(....Aj.@............pZ..............................text...._Z......`Z................. ..`.rdata..ZR...pZ..T...dZ.............@..@.data....+....r.......r.............@....pdata........t.......s.............@..@.reloc........x.......w.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	792856
Entropy (8bit):	5.57949182561317
Encrypted:	false
SSDEEP:	12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5:	4FF168AAA6A1D68E7957175C8513F3A2
SHA1:	782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
SHA-256:	2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
SHA-512:	C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...\|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\psutil\_psutil_windows.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	5.909510426434191
Encrypted:	false
SSDEEP:	1536:aJsHmR02IvVxv7WCyKm7c5Th4MBHTOvyyaZE:apIvryCyKx5Th4M5OvyyO
MD5:	3E579844160DE8322D574501A0F91516
SHA1:	C8DE193854F7FC94F103BD4AC726246981264508
SHA-256:	95F01CE7E37F6B4B281DBC76E9B88F28A03CB02D41383CC986803275A1CD6333
SHA-512:	EE2A026E8E70351D395329C78A07ACB1B9440261D2557F639E817A8149BA625173EF196AED3D1C986577D78DC1A7EC9FED759C19346C51511474FE6D235B1817
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..5..5..5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d.....qf.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	201496
Entropy (8bit):	6.37966632089213
Encrypted:	false
SSDEEP:	3072:gLWGOBH4P4xPmoeIUBEfZp6fcZW9i4pBgSdQn5UbLiiZcAAn7FJX7r5IvLh8N:1BH4PkPmoeIUKfZp6fceqmQ5U4Nr/
MD5:	B34CA0FCD5E0E4F060FE211273AC2946
SHA1:	F7E978EB8ADDA4BF74739EF71901E0E3AA12EA8C
SHA-256:	B6670D91A76E9F00609752AB19AAE0B1EBE00D24D9D8D22068989BBB24D0AA44
SHA-512:	010774770DD5C4355C336ECE7BFB729D2E616BBA62BFB9961324D3B314396F1F535B5ADF50621BFC0517C03587C912568E19602173A43F297A5F638AA9296500
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P..P..P..(t..P.....P.....P.....P.....P....P.(..P..P.P....P....P.....P....P.Rich.P.........PE..d....g.f.........." ...)............p........................................ ......s.....`.............................................P................................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata...... ......................@..@.data...p ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\python3.dll

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68376
Entropy (8bit):	6.149720380115211
Encrypted:	false
SSDEEP:	768:XV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/c:XDmF61JFn+/Oi5IvL0b7Sykxr
MD5:	2E2BB725B92A3D30B1E42CC43275BB7B
SHA1:	83AF34FB6BBB3E24FF309E3EBC637DD3875592A5
SHA-256:	D52BACA085F88B40F30C855E6C55791E5375C80F60F94057061E77E33F4CAD7A
SHA-512:	E4A500287F7888B1935DF40FD0D0F303B82CBCF0D5621592805F3BB507E8EE8DE6B51BA2612500838D653566FAD18A04F76322C3AB405CE2FDBBEFB5AB89069E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d....g.f.........." ...)............................................................'.....`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\python312.dll

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6916376
Entropy (8bit):	5.766275790250782
Encrypted:	false
SSDEEP:	49152:YeceS1L2qpQvgBciWdyVahNTjy8VtvUt1wX/n8gRymPMVTBl2XhXNtMH2lt6cSA/:+RzBHWwuVGij3vwHDMiEHtSzW
MD5:	B243D61F4248909BC721674D70A633DE
SHA1:	1D2FB44B29C4AC3CFD5A7437038A0C541FCE82FC
SHA-256:	93488FA7E631CC0A2BD808B9EEE8617280EE9B6FF499AB424A1A1CBF24D77DC7
SHA-512:	10460C443C7B9A6D7E39AD6E2421B8CA4D8329F1C4A0FF5B71CE73352D2E9438D45F7D59EDB13CE30FAD3B4F260BD843F4D9B48522D448310D43E0988E075FCB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>._..._..._......_....\|.._......_......_......_...'..._...'..._..._...^.....B_......_....~.._......_..Rich._..................PE..d....g.f.........." ...)..'...B......h.......................................Pj......"j...`..........................................<N.......O.......h......._.8J...Zi../....h..Z..0u2.T....................qH.(....s2.@.............(..............................text.....'.......'................. ..`.rdata...0'...(..2'...'.............@..@.data....H...@O.......O.............@....pdata..8J...._..L....^.............@..@PyRuntimh.....a.......`.............@....rsrc.........h.......g.............@..@.reloc...Z....h..\....g.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\pywin32_system32\pywintypes312.dll

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134656
Entropy (8bit):	5.9953900911096785
Encrypted:	false
SSDEEP:	3072:Yuh2G0a2fYrFceQaVK756Y/r06trvoEKQAe7KL8KJKVKGajt4:Yuh2faiYrFceQaVfY/rxTBAe7KwKwVrE
MD5:	26D752C8896B324FFD12827A5E4B2808
SHA1:	447979FA03F78CB7210A4E4BA365085AB2F42C22
SHA-256:	BD33548DBDBB178873BE92901B282BAD9C6817E3EAC154CA50A666D5753FD7EC
SHA-512:	99C87AB9920E79A03169B29A2F838D568CA4D4056B54A67BC51CAF5C0FF5A4897ED02533BA504F884C6F983EBC400743E6AD52AC451821385B1E25C3B1EBCEE0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.$g..wg..wg..wn.[wk..w5..vc..w..5wf..w5..vs..w5..vo..w5..vd..ws..vf..w...ve..ws..vl..wg..w...w...vj..w...vf..w...vf..wRichg..w........PE..d......d.........." ................L........................................P............`......................................... u..`B......,....0..l.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..R...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\select.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31000
Entropy (8bit):	6.555355105424351
Encrypted:	false
SSDEEP:	384:TRVBP9tKLhuosHfwTgDo90Y5IvQGsHQIYiSy1pCQzpuKAM+o/8E9VF0Ny33H:5FyMHfv2H5IvQGW5YiSyvIKAMxkEtH
MD5:	7E871444CA23860A25B888EE263E2EAF
SHA1:	AA43C9D3ABDB1AABDA8379F301F8116D0674B590
SHA-256:	DCA5E6D39C5094CE599143CB82F6D8470F0C2A4CE4443499E73F32ED13333FD0
SHA-512:	2E260D3123F7CA612901513B90FE40739E85248DA913297D4CCA3B2EBD398D9697880D148830E168E474EBFC3D30EDE10668C7316ED7668F8B39DA7BCA59E57D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d....g.f.........." ...).....2......................................................fT....`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...`....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\autocommand-2.2.2.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\autocommand-2.2.2.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7634
Entropy (8bit):	4.503638339817033
Encrypted:	false
SSDEEP:	192:qnJvhVL0qhYqlpIle4RrJQSqOBng4kS/cKM6b:4vjxhYWpce48engvK
MD5:	8466CFC6533376D42EFA6F7423F2B8E8
SHA1:	2BC8926FDBB07DB2AF0A8E3FF7A3BE545C8BDF6B
SHA-256:	ADE78D04982D69972D444A8E14A94F87A2334DD3855CC80348EA8E240AA0DF2D
SHA-512:	CC45DC470E107E63659B502F77E9EF44335F9427BE87639252D85181A8DEA65FA9D1B5F1BD196F782186BC61B144467888199537806A8CC15E2B462CAC0D46A5
Malicious:	false
Preview:	GNU LESSER GENERAL PUBLIC LICENSE. Version 3, 29 June 2007.. Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed.... This version of the GNU Lesser General Public License incorporates.the terms and conditions of version 3 of the GNU General Public.License, supplemented by the additional permissions listed below... 0. Additional Definitions... As used herein, "this License" refers to version 3 of the GNU Lesser.General Public License, and the "GNU GPL" refers to version 3 of the GNU.General Public License... "The Library" refers to a covered work governed by this License,.other than an Application or a Combined Work as defined below... An "Application" is any work that makes use of an interface provided.by the Library, but which is not otherwise based on the Library..Defining a subclass of a class defined by the Library is de

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\autocommand-2.2.2.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	Python script, ASCII text executable, with very long lines (855)
Category:	dropped
Size (bytes):	15006
Entropy (8bit):	4.800156894367144
Encrypted:	false
SSDEEP:	192:S037UxjwUbQd1Ak++k59jg8dXRNInXF2IOxcme+kQBd9Clb:d37U1LbQd1Z+3e8dhwXFacb+kQjQb
MD5:	542BA4FBC993C39A0BC952BE72E8717F
SHA1:	4310DB58F98C12B23286E5FA37F0E27ABEFB6A4A
SHA-256:	3800D9B91DCEEA2065A6ED6279383362E97AC38B8E56B9343F404EE531860099
SHA-512:	E3672EA056E5F2EFD3685C98DC0CF47E9A44F5A84DC457FC8AB31CD6DE09559C6E566D2D00F5B3CE55511E81A050DBB0DED6CF941916A6FF1019392FD96E1636
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: autocommand.Version: 2.2.2.Summary: A library to create a command-line program from a function.Home-page: https://github.com/Lucretiel/autocommand.Author: Nathan West.License: LGPLv3.Project-URL: Homepage, https://github.com/Lucretiel/autocommand.Project-URL: Bug Tracker, https://github.com/Lucretiel/autocommand/issues.Platform: any.Classifier: Development Status :: 6 - Mature.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3).Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Topic :: Software Development.Classifier: Topic :: Software Development :: Libraries.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Requires-Python: >=3.7.Description-Content-Type: text/markdown.License-File: LICENSE..[![PyPI version](https://badge.fury.io/py/autocommand.svg)](

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\autocommand-2.2.2.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.721750099226425
Encrypted:	false
SSDEEP:	24:kn/2zDcMvX4owkE+RlpGUttyvUMDtuH5p4D127cyOMT34:knuXNv4LkEMl0UWMF5p45AcuT34
MD5:	52BF4937018B88B9D28ED98A76B5E2AC
SHA1:	C8D5B732C154A2D4D501454647FAFEB356B93C4E
SHA-256:	822BBA66B41526FA547186B80221F85DA50D652BEE5493DBFE5D14085112F0C3
SHA-512:	30E4DEFE09FB8907166682F9A33E0F7CC0203B65113155BBEC6548A1EADF7250882AF295FF2551803703274F9F387E00439D95CBBCB63D2E04E371B94556B3EE
Malicious:	false
Preview:	autocommand-2.2.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..autocommand-2.2.2.dist-info/LICENSE,sha256=reeNBJgtaZctREqOFKlPh6IzTdOFXMgDSOqOJAqg3y0,7634..autocommand-2.2.2.dist-info/METADATA,sha256=OADZuR3O6iBlpu1ieTgzYul6w4uOVrk0P0BO5TGGAJk,15006..autocommand-2.2.2.dist-info/RECORD,,..autocommand-2.2.2.dist-info/WHEEL,sha256=2wepM1nk4DS4eFpYrW1TTqPcoGNfHhhO_i5m4cOimbo,92..autocommand-2.2.2.dist-info/top_level.txt,sha256=AzfhgKKS8EdAwWUTSF8mgeVQbXOY9kokHB6kSqwwqu0,12..autocommand/__init__.py,sha256=zko5Rnvolvb-UXjCx_2ArPTGBWwUK5QY4LIQIKYR7As,1037..autocommand/__pycache__/__init__.cpython-312.pyc,,..autocommand/__pycache__/autoasync.cpython-312.pyc,,..autocommand/__pycache__/autocommand.cpython-312.pyc,,..autocommand/__pycache__/automain.cpython-312.pyc,,..autocommand/__pycache__/autoparse.cpython-312.pyc,,..autocommand/__pycache__/errors.cpython-312.pyc,,..autocommand/autoasync.py,sha256=AMdyrxNS4pqWJfP_xuoOcImOHWD-qT7x06wmKN1Vp-U,5680..autocommand/autoco

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\autocommand-2.2.2.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.842566724466667
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViJR4KgP+tPCCfA5S:RtBMwlVifAWBBf
MD5:	88F09A0EC874FD86ABCB9BC4E265B874
SHA1:	786AB44FFD2F5C632B4DC5C1BF4AA2E91E579A05
SHA-256:	DB07A93359E4E034B8785A58AD6D534EA3DCA0635F1E184EFE2E66E1C3A299BA
SHA-512:	7FFEF1EC782D590D2879294C2895A5A8064ECD5FE7243CF602FCCE66A8A715F64436F17CE96070B613123847EE0C18AB0AA5BC87DB13E98A792DC07DD95E4BAB
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.38.4).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\autocommand-2.2.2.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.084962500721156
Encrypted:	false
SSDEEP:	3:5EEln:aM
MD5:	C3FBD7931840D987F261BEBA8C77C4D2
SHA1:	F7EE740BCB5C39966173CC377817A157D55844F7
SHA-256:	0337E180A292F04740C16513485F2681E5506D7398F64A241C1EA44AAC30AAED
SHA-512:	E1FA2DE0EE416AE68C57A0173C82D42A8F24DDD1E5143A1B76A3743B5EC3DDF11FB3950F27469D3D8FCAC4958CE267A7321D2F888671EDD7C2E95D0F3F8F7455
Malicious:	false
Preview:	autocommand.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2020
Entropy (8bit):	5.0469065437932175
Encrypted:	false
SSDEEP:	48:DfdqaaC3P1xe9okGw1w8wQwywbM0kvsJib0ts++kv0gMzvy0htC+heU01:DfdqaaC/12G2bHZokO+/36
MD5:	18B352E2051962B9F65C33BC651426BF
SHA1:	3DD8D93CF7695D1C9D7574751AB5B0DEE5DD7F9A
SHA-256:	8215C54EAD77D9DC5A108A25C6BDC72B5999AA6F62C9499A440359412AFA5A51
SHA-512:	D966BC2899079C0D9AC763C96EA59A550E00A54BDCEEB6D96B0A8CAA9F6A1C408E7E3946915432978EDE9EDF669EEC68035A55B094B69671A28428458760D99E
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: backports.tarfile.Version: 1.2.0.Summary: Backport of CPython tarfile module.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/backports.tarfile.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Provides-Extra: testing.Requires-Dist: pytest !=8.1.*,>=6 ; extra == 'testing'.Requires-Dist: pytest-checkdocs >=2.4 ; extra == 'testing'.Requires-Dist: pytest-cov ; extra == 'testing

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	5.753738299642538
Encrypted:	false
SSDEEP:	24:U6rn/2zDJ6rvbqfuG6rJnB6rU6rEsJYB6rXamx6rlCHmTKjaQliwxJlp5DQljQls:NnuXIzUurJwN5JjfAlqYK9liSlp5DQlP
MD5:	CF347AE8E31132435B127226F358F8CD
SHA1:	2C857B300638FF291651234BBB2C077BEEF494E4
SHA-256:	258A1F1C849E1175069A55A5D6CE357AFDD04E34CD5DE27093E4ACEC7A9D2CE1
SHA-512:	2A46C7FDFA2F9883BB1D761646B33BE9CE7B07280A5BF38992C1C84AB0449944EB0CAF34620CCC82DDBBC193F0D54AE67797D97863F70CA0C24EE55A3B401F9C
Malicious:	false
Preview:	backports.tarfile-1.2.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..backports.tarfile-1.2.0.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..backports.tarfile-1.2.0.dist-info/METADATA,sha256=ghXFTq132dxaEIolxr3HK1mZqm9iyUmaRANZQSr6WlE,2020..backports.tarfile-1.2.0.dist-info/RECORD,,..backports.tarfile-1.2.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..backports.tarfile-1.2.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..backports.tarfile-1.2.0.dist-info/top_level.txt,sha256=cGjaLMOoBR1FK0ApojtzWVmViTtJ7JGIK_HwXiEsvtU,10..backports/__init__.py,sha256=iOEMwnlORWezdO8-2vxBIPSR37D7JGjluZ8f55vzxls,81..backports/__pycache__/__init__.cpython-312.pyc,,..backports/tarfile/__init__.py,sha256=Pwf2qUIfB0SolJPCKcx3vz3UEu_aids4g4sAfxy94qg,108491..backports/tarfile/__main__.py,sha256=Yw2oGT1afrz2eBskzdPYL8ReB_3liApmhFkN2EbDmc4,59..backports/tarfile/__pycache__/__init__.cpython-312.pyc,,..back

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:21v:ev
MD5:	9BA458821AD258B6EF62B47E91302982
SHA1:	9EDB9E6BA5C4001CE2FCCF328739292404EA9604
SHA-256:	7068DA2CC3A8051D452B4029A23B73595995893B49EC91882BF1F05E212CBED5
SHA-512:	3A296E5DADD5B406330BA088BFED33BE6960F8FF42DB6651E185FF14F2272FC819EF520D1A15BC40DA4E20B9CA0E5D79170EDF33F3D50937C7FBEDB338CAC730
Malicious:	false
Preview:	backports.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4648
Entropy (8bit):	5.006900644756252
Encrypted:	false
SSDEEP:	96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
MD5:	98ABEAACC0E0E4FC385DFF67B607071A
SHA1:	E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
SHA-256:	6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
SHA-512:	F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2518
Entropy (8bit):	5.6307766747793275
Encrypted:	false
SSDEEP:	48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
MD5:	EB513CAFA5226DDA7D54AFDCC9AD8A74
SHA1:	B394C7AEC158350BAF676AE3197BEF4D7158B31C
SHA-256:	0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
SHA-512:	A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
Malicious:	false
Preview:	importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.687870576189661
Encrypted:	false
SSDEEP:	3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
MD5:	7D09837492494019EA51F4E97823D79F
SHA1:	7829B4324BB542799494131A270EC3BDAD4DEDEF
SHA-256:	9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
SHA-512:	A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.536886723742169
Encrypted:	false
SSDEEP:	3:JSej0EBERG:50o4G
MD5:	A24465F7850BA59507BF86D89165525C
SHA1:	4E61F9264DE74783B5924249BCFE1B06F178B9AD
SHA-256:	08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
SHA-512:	ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
Malicious:	false
Preview:	importlib_metadata.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_resources-6.4.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_resources-6.4.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_resources-6.4.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3944
Entropy (8bit):	5.015824473130961
Encrypted:	false
SSDEEP:	96:DHxQuiTaCP1nTGDbHRbnzQWHaiQq+fT5lWp8sSwTW:2PP9GDbHRbnp+rapPSwTW
MD5:	C3EB48CD13B50DDED7CD524E1E9DD4CE
SHA1:	7C9B0B50D0E667825DAB09902AD8376A5F2945B6
SHA-256:	83878CD8BB8BD0E89971454D0F4AB00C9529136F603AFB4EDC148F5D36CEF459
SHA-512:	056EBC250B7E82F91B5C5E96B1293F24D5E917E06846A9716A4D05B47C30FEB3781E439C77876CF7D8620BEBAA4A253039CA8DF122283DE304992E340F4DE8BF
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: importlib_resources.Version: 6.4.0.Summary: Read resources from Python packages.Home-page: https://github.com/python/importlib_resources.Author: Barry Warsaw.Author-email: barry@python.org.Project-URL: Documentation, https://importlib-resources.readthedocs.io/.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.License-File: LICENSE.Requires-Dist: zipp >=3.1.0 ; python_version < "3.10".Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: sphinx <7.2.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Requires-Dist: jaraco.tidelift >=1.4 ; ext

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_resources-6.4.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	7620
Entropy (8bit):	5.560551717923108
Encrypted:	false
SSDEEP:	192:lX7qdX7ZgsP7JtILSVAn5V26+XuVYmBXx:lX7wX7ZBP7ELSVAni6+iBh
MD5:	67F5E26385B6BDCF2236A005A2D2BA32
SHA1:	3DCD8685638A90D121FD484138AFCAC9775E5D66
SHA-256:	967DD56FEEA143F1D2C4E98AC1F937C055E61C9AA0425146D55F7AD7C82510FA
SHA-512:	30B5812E930A00A476E570EBCC4611D54C911A8B1E4646949A887F551FC5ABDC933311A554B197C602F0DA7626DFE8877A3F267EFBC6D724E24A3E9B5FCC2E30
Malicious:	false
Preview:	importlib_resources-6.4.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_resources-6.4.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_resources-6.4.0.dist-info/METADATA,sha256=g4eM2LuL0OiZcUVND0qwDJUpE29gOvtO3BSPXTbO9Fk,3944..importlib_resources-6.4.0.dist-info/RECORD,,..importlib_resources-6.4.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_resources-6.4.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..importlib_resources-6.4.0.dist-info/top_level.txt,sha256=fHIjHU1GZwAjvcydpmUnUrTnbvdiWjG4OEVZK8by0TQ,20..importlib_resources/__init__.py,sha256=uyp1kzYR6SawQBsqlyaXXfIxJx4Z2mM8MjmZn8qq2Gk,505..importlib_resources/__pycache__/__init__.cpython-312.pyc,,..importlib_resources/__pycache__/_adapters.cpython-312.pyc,,..importlib_resources/__pycache__/_common.cpython-312.pyc,,..importlib_resources/__pycache__/_itertools.cpython-312.pyc,,..importlib_resource

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_resources-6.4.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\importlib_resources-6.4.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6841837197791887
Encrypted:	false
SSDEEP:	3:JSe8AW6D:3fD
MD5:	0613840F692BD9E064FEDD915DFD477A
SHA1:	64DF38B36F541BA1714C15FCA1A9CA8C94EF2DAA
SHA-256:	7C72231D4D46670023BDCC9DA6652752B4E76EF7625A31B83845592BC6F2D134
SHA-512:	78AA888C24B3468C94FCB8EB882561D4B6F19A0537A4CFDDDFF94ED8A4BAFE8DF0C2B620E70B57A61E8BA3F877856DB9ADA548DFCA8CAE86D4C3C525A4E9B7EB
Malicious:	false
Preview:	importlib_resources.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\inflect-7.3.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\inflect-7.3.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\inflect-7.3.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21079
Entropy (8bit):	5.103530371859935
Encrypted:	false
SSDEEP:	384:12Vpnu38/2K9tjUaNtT/yTCtYTnWDdg3GaXb51KLVgWTVPeEGsuPrAESM:12Vpnu38JZtT/yIdg3D51KLV7RPeEGs+
MD5:	1A287FAF08B125BC7C932AAD05E7DAEE
SHA1:	C37042ADC0D1270485F4B8B5B9E085A274DC035B
SHA-256:	66030D634580651B3E53CC19895D9231F8D22AA06B327817C8332CFC20303308
SHA-512:	D0BB0AD27A17007DF7D3281FB2F46EFB048B69532D082AB1D431E0BA28E592D897687708B4EC972F4BC21EDA29DDDDC9EF44BB950DFC4FFB03EA75CDA4DE414C
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: inflect.Version: 7.3.1.Summary: Correctly generate plurals, singular nouns, ordinals, indefinite articles.Author-email: Paul Dyson <pwdyson@yahoo.com>.Maintainer-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/jaraco/inflect.Keywords: plural,inflect,participle.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Natural Language :: English.Classifier: Operating System :: OS Independent.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic :: Text Processing :: Linguistic.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: more-itertools >=8.5.0.Requires-Dist: typeguard >=4.0.1.Requires-Dist: typing-extensions ; python_version < "3.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\inflect-7.3.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	943
Entropy (8bit):	5.828988691860191
Encrypted:	false
SSDEEP:	24:IVn/2zDPvbqfuIpBntmuIcjlM+sVGXdbkDcnJopDvDK16bZWJV:unuXPzUuIpRtmuZjl9sVQgcnJo9bK16E
MD5:	C837BB3258448B7FCC6B77559C7F17B6
SHA1:	B15701449CD64A13756A70AD3704E26DB1FF416B
SHA-256:	5D7834AC1BA2612C6801050FDE57A7B98B0F36ACF88C3C2D4F376FD8911B3091
SHA-512:	2333CD86502C51607414390ECF43BD6D62E863D3DFB0501DAD3A8B45F5F4DFA81F910917183FC4F4A0DEEC82C8F8B3CF8D5B0A2C136DEB164226BABE68B74A33
Malicious:	false
Preview:	inflect-7.3.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..inflect-7.3.1.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..inflect-7.3.1.dist-info/METADATA,sha256=ZgMNY0WAZRs-U8wZiV2SMfjSKqBrMngXyDMs_CAwMwg,21079..inflect-7.3.1.dist-info/RECORD,,..inflect-7.3.1.dist-info/WHEEL,sha256=y4mX-SOX4fYIkonsAGA5N0Oy-8_gI4FXw5HNI1xqvWg,91..inflect-7.3.1.dist-info/top_level.txt,sha256=m52ujdp10CqT6jh1XQxZT6kEntcnv-7Tl7UiGNTzWZA,8..inflect/__init__.py,sha256=Jxy1HJXZiZ85kHeLAhkmvz6EMTdFqBe-duvt34R6IOc,103796..inflect/__pycache__/__init__.cpython-312.pyc,,..inflect/compat/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..inflect/compat/__pycache__/__init__.cpython-312.pyc,,..inflect/compat/__pycache__/py38.cpython-312.pyc,,..inflect/compat/py38.py,sha256=oObVfVnWX9_OpnOuEJn1mFbJxVhwyR5epbiTNXDDaso,160..inflect/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\inflect-7.3.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.7098485981676825
Encrypted:	false
SSDEEP:	3:RtEeXMRYFAVLKSgP+tPCCfA5S:RtC1VLKZWBBf
MD5:	EB46A94D39AC40E2EEA4A32729E0C8C3
SHA1:	E42EF49A7098269E1934932ECC3174B40967982A
SHA-256:	CB8997F92397E1F6089289EC0060393743B2FBCFE0238157C391CD235C6ABD68
SHA-512:	D89F0DA16AA37AAFAC0DE56A3DFBD72DC3C9DCC53C8E455094E7230DB21ABF95ED76EAC1848A4156DB422B9C10BE136201D871DCCB73AD38192E5536E41DBDFE
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: setuptools (70.2.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\inflect-7.3.1.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:KDpJ:K9J
MD5:	4571281D24750CBE7638EFE250E342AB
SHA1:	61E8A0AD5796F1CA67EAB0D8108A6402483D499B
SHA-256:	9B9DAE8DDA75D02A93EA38755D0C594FA9049ED727BFEED397B52218D4F35990
SHA-512:	E7807002E53CC228D6EFB307E928C6737796B29E31D25A342ED407F556FFBF540494FE92C27B5C31043D2D7FF427C78A29C4FF5595BC11BB643003026642254E
Malicious:	false
Preview:	inflect.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.collections-5.1.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.collections-5.1.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.collections-5.1.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3933
Entropy (8bit):	4.993707893382395
Encrypted:	false
SSDEEP:	96:D0duaC9zmnEh2S8xI0+4np+A+fbl7inVgQJSwT2:qq9KnEh2zxI0+4npn+zlmn+QJSwT2
MD5:	C9BA49C9B82CEFCCAC79CB5B76BCB1EE
SHA1:	AC0DB25AEFD2679B4C3265E713D00F6155A94465
SHA-256:	20C51A96236C0395F53B1F4C5D458E6A0721E51E16C1BFF733B7ABA76F5D06D8
SHA-512:	563C3BEC6FB8D137357130BADCB63A229A18A781B05E2F006F4A42AF7C9052D23D266908DA2E62FF283C9BA7BAA9B6CB6FB32A1999CB07F63471CA43003A34C0
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: jaraco.collections.Version: 5.1.0.Summary: Collection objects similar to those in stdlib by jaraco.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/jaraco/jaraco.collections.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: jaraco.text.Provides-Extra: check.Requires-Dist: pytest-checkdocs >=2.4 ; extra == 'check'.Requires-Dist: pytest-ruff >=0.2.1 ; (sys_platform != "cygwin") and extra == 'check'.Provides-Extra: cover.Requires-Dist: pytest-cov ; extra == 'cover'.Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.collections-5.1.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	873
Entropy (8bit):	5.770829319764291
Encrypted:	false
SSDEEP:	24:T9bn/2zDabvbqfunb1AO5bGYbEsJvbp1blKzmKmJaaX9WJV:T9bnuXabzUunb1AgbBb5Jvbp1blscWJV
MD5:	0463062305AC30E7F3D6AB12DA825D90
SHA1:	AC83602461BF535C78EB4CCC13AB103C12110D57
SHA-256:	1E9B62BD70E4A5FA26E9594CBB80860FFECA3DEBFEE8773DAEFA774CD259CA06
SHA-512:	8F617D9A2DA41BDC8591D9EA9F2DBE79D7C5816BA7A94D4044AFF2A0504C9738E83FFCAA350CEF20764D430C261C9DC17DBB5E4ABB7AE54C3BE8715C8AD6BB71
Malicious:	false
Preview:	jaraco.collections-5.1.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..jaraco.collections-5.1.0.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..jaraco.collections-5.1.0.dist-info/METADATA,sha256=IMUaliNsA5X1Ox9MXUWOagch5R4Wwb_3M7erp29dBtg,3933..jaraco.collections-5.1.0.dist-info/RECORD,,..jaraco.collections-5.1.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..jaraco.collections-5.1.0.dist-info/WHEEL,sha256=Mdi9PDNwEZptOjTlUcAth7XJDFtKrHYaQMPulZeBCiQ,91..jaraco.collections-5.1.0.dist-info/top_level.txt,sha256=0JnN3LfXH4LIRfXL-QFOGCJzQWZO3ELx4R1d_louoQM,7..jaraco/collections/__init__.py,sha256=Pc1-SqjWm81ad1P0-GttpkwO_LWlnaY6gUq8gcKh2v0,26640..jaraco/collections/__pycache__/__init__.cpython-312.pyc,,..jaraco/collections/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.collections-5.1.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.696166043246402
Encrypted:	false
SSDEEP:	3:RtEeXMRYFAWWHKRRP+tPCCfA5S:RtC1qjWBBf
MD5:	6FBE8610D7E48CA32AE774804C4A0B19
SHA1:	102D23C4ECB17ED83A6E43888B45FF2BBFE93E0B
SHA-256:	31D8BD3C3370119A6D3A34E551C02D87B5C90C5B4AAC761A40C3EE9597810A24
SHA-512:	78738099EC5B31FDEE5AE50F7840F17EFD526588835157CADF4249882462B1AF2E3BEDB77801A9FCB1D22A8FD41AA6A934B382F3E66309723D0E7F93C2F2868A
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: setuptools (73.0.1).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.collections-5.1.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:GEG0:GEG0
MD5:	0BA8D736B7B4AB182687318B0497E61E
SHA1:	311BA5FFD098689179F299EF20768EE1A29F586D
SHA-256:	D099CDDCB7D71F82C845F5CBF9014E18227341664EDC42F1E11D5DFE5A2EA103
SHA-512:	7CCCBB4AFA2FADE40D529482301BEAE152E0C71EE3CC41736EB19E35CFC5EE3B91EF958CF5CA6B7330333B8494FEB6682FD833D5AA16BF4A8F1F721FD859832C
Malicious:	false
Preview:	jaraco.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.context-5.3.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.context-5.3.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.context-5.3.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text, with very long lines (406)
Category:	dropped
Size (bytes):	4020
Entropy (8bit):	4.99859161164956
Encrypted:	false
SSDEEP:	96:D6P4YaCP1gGRbHneRohWYc+f/PCnG9rulJQ84UNxCUSwTcL:kPqGRbHneRohWJ+XPaqylW/USwTcL
MD5:	812F27A7C8C748351DC1643D58B6B250
SHA1:	AC9C92013B2F0FC65D741B32A9FE4B956DD6EB7D
SHA-256:	C43B60B897A3D2D37D8845C252FC44261D9AEF171E21154111A9012D2AFFFED6
SHA-512:	CAC62C3682F808D85233B69F1C142B5A0E95E316E4BDCBC6EE253583EC302FA42E635BAB6A837327D8CE5D26C08C8DCD9E45D5CFDD8346B4501C473250D66953
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: jaraco.context.Version: 5.3.0.Summary: Useful decorators and context managers.Home-page: https://github.com/jaraco/jaraco.context.Author: Jason R. Coombs.Author-email: jaraco@jaraco.com.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.License-File: LICENSE.Requires-Dist: backports.tarfile ; python_version < "3.12".Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'docs'.Provides-Extra: testing.Requires-Dist: pytest !=8.1.1,>=6 ; extra == 'testing'.Requires-Dist: pytest-checkdocs >=2.4

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.context-5.3.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	641
Entropy (8bit):	5.76835538630355
Encrypted:	false
SSDEEP:	12:TGA0a/2zDJAv/TnqfQlWJAL/fy9vKAGvAXCaaryBAl2VrkEQCXvbAT2r1S:TBn/2zDCvbqfuLO9FGoXamalKSCXzB1S
MD5:	2B0A77624AE3903E42C3A8213E593796
SHA1:	D63027FF018995D0620E2497BCE9678888A57667
SHA-256:	55197B88A78443297BB2D827A75BAAE740B33896251D872835D4B4C75EC2F57E
SHA-512:	C02FB1554F8F40158BB60F2B4EC07D80F71CFBFFB38463C5809385A7A2FF8DDB2BDFEFE9AE5E67F4DEC3D904A6E0925E565B0EE6363DD0C2ED5B03A96B056B18
Malicious:	false
Preview:	jaraco.context-5.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..jaraco.context-5.3.0.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..jaraco.context-5.3.0.dist-info/METADATA,sha256=xDtguJej0tN9iEXCUvxEJh2a7xceIRVBEakBLSr__tY,4020..jaraco.context-5.3.0.dist-info/RECORD,,..jaraco.context-5.3.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..jaraco.context-5.3.0.dist-info/top_level.txt,sha256=0JnN3LfXH4LIRfXL-QFOGCJzQWZO3ELx4R1d_louoQM,7..jaraco/__pycache__/context.cpython-312.pyc,,..jaraco/context.py,sha256=REoLIxDkO5MfEYowt_WoupNCRoxBS5v7YX2PbW8lIcs,9552..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.context-5.3.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.context-5.3.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:GEG0:GEG0
MD5:	0BA8D736B7B4AB182687318B0497E61E
SHA1:	311BA5FFD098689179F299EF20768EE1A29F586D
SHA-256:	D099CDDCB7D71F82C845F5CBF9014E18227341664EDC42F1E11D5DFE5A2EA103
SHA-512:	7CCCBB4AFA2FADE40D529482301BEAE152E0C71EE3CC41736EB19E35CFC5EE3B91EF958CF5CA6B7330333B8494FEB6682FD833D5AA16BF4A8F1F721FD859832C
Malicious:	false
Preview:	jaraco.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2891
Entropy (8bit):	5.034580807599395
Encrypted:	false
SSDEEP:	48:DEmbsaC3J1x9Ie9okNGwQw8wQw2wTw0zCPU0+I65Jib0H++kv0gM5d0DT+heU04u:DEmgaCZ1nTGDbHRAnzpI6o+fX5dFSwTm
MD5:	C2E6BDA7F1B03B39BF42D31B6DBF6C38
SHA1:	B7A18F079DE22D10C4C318E54BD8C48177F91333
SHA-256:	8B86946900D7FA38DD1102B9C1EBE17A0CB1F09C8B7E29F61F2BDA4A4DC51ECA
SHA-512:	F4E892B3D41482E3B17642B1D722B6E2A8E8DD4833F0623C29ED2D50D55CFC68DA1F9756B4E08723DC89F3E552424096C92912AC4DA533FE8E2DC59DC19EA9CF
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: jaraco.functools.Version: 4.0.1.Summary: Functools like those found in stdlib.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/jaraco.functools.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: more-itertools.Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: sphinx <7.2.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'docs'.Provides-Extra: testing.Requires-Dist: pytest >=6 ;

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.807846597836061
Encrypted:	false
SSDEEP:	24:Tmn/2zDRvbqfuggoaGnXamZlKZBX3vpBvt+c0X4yWJV:TmnuXRzUuggDifZlmX/aWJV
MD5:	85FB54BAFB143CD57D1787F7EF74FDB2
SHA1:	A915BBCDF108A58F3DFC1783D9D4DD3B7F3CE23A
SHA-256:	632AA7C04F7C4BCC01C027AF5B9BC76FE8958F4A181035B957A3BD3014BA248B
SHA-512:	2A39B4C6F221F88EC61D584C8CD3CAD358E8C7B50E529192105A0A4144ED3C2A4CE8B630C39C18D20E27FE226A23E2DE23CDFF8E3D3693959B165A9A2F9047CD
Malicious:	false
Preview:	jaraco.functools-4.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..jaraco.functools-4.0.1.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..jaraco.functools-4.0.1.dist-info/METADATA,sha256=i4aUaQDX-jjdEQK5wevhegyx8JyLfin2HyvaSk3FHso,2891..jaraco.functools-4.0.1.dist-info/RECORD,,..jaraco.functools-4.0.1.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..jaraco.functools-4.0.1.dist-info/top_level.txt,sha256=0JnN3LfXH4LIRfXL-QFOGCJzQWZO3ELx4R1d_louoQM,7..jaraco/functools/__init__.py,sha256=hEAJaS2uSZRuF_JY4CxCHIYh79ZpxaPp9OiHyr9EJ1w,16642..jaraco/functools/__init__.pyi,sha256=gk3dsgHzo5F_U74HzAvpNivFAPCkPJ1b2-yCd62dfnw,3878..jaraco/functools/__pycache__/__init__.cpython-312.pyc,,..jaraco/functools/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:GEG0:GEG0
MD5:	0BA8D736B7B4AB182687318B0497E61E
SHA1:	311BA5FFD098689179F299EF20768EE1A29F586D
SHA-256:	D099CDDCB7D71F82C845F5CBF9014E18227341664EDC42F1E11D5DFE5A2EA103
SHA-512:	7CCCBB4AFA2FADE40D529482301BEAE152E0C71EE3CC41736EB19E35CFC5EE3B91EF958CF5CA6B7330333B8494FEB6682FD833D5AA16BF4A8F1F721FD859832C
Malicious:	false
Preview:	jaraco.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.text-3.12.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.text-3.12.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.text-3.12.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3658
Entropy (8bit):	5.02710641474483
Encrypted:	false
SSDEEP:	96:DYMaCFS802Vpnu388Ksc+fIybwFiR8g6RSwTsL:pFz02Vpnu388KB+gybwgRd6RSwTsL
MD5:	70FE732EDE8F8E6C84DA4EA21D4933E5
SHA1:	A7763789FA56CEBBAA849368FAAC7D386F170399
SHA-256:	03359D9BA56231F0CE3E840C7CB5A7DB380141218949CCAA78DDBD4DCB965D52
SHA-512:	4C8D3D5078840BD4DBE20458EBF52890585C5911C22C3EFCE2FB28985461BC80469339DDAF6016FB099C84BDF9B41A26FF1884B456422A8D0C682104D7950D91
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: jaraco.text.Version: 3.12.1.Summary: Module for text manipulation.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/jaraco.text.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: jaraco.functools.Requires-Dist: jaraco.context >=4.1.Requires-Dist: autocommand.Requires-Dist: inflect.Requires-Dist: more-itertools.Requires-Dist: importlib-resources ; python_version < "3.9".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.text-3.12.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1500
Entropy (8bit):	5.794249493238335
Encrypted:	false
SSDEEP:	24:TkLFn/2zDVLFvbqfuaLFo2kXLFGnLFEsJiLFXamdLFlKbkZ6d3JpPXu/1XWXYXw2:TcnuXDzUuuCw5Jmfblyz3Jp2/NUsM0bN
MD5:	39FCCE64BC768C2046067E4AAD8465F0
SHA1:	2EFC0FC776576A8FE01BBACD0760A49EEE6481DA
SHA-256:	816D945741DCA246099388CA3EED74FC0667ACBAA36F70B559B2494C3979B1F6
SHA-512:	FB2335A6675F9CADEEE38B666FAB9EA1D8BFBA6B7768253D42F44149591A3239F4B2FA19DDF2C282DC7E47A01D7DCA69AADBBCDAC9107EDBCB2C22D11BA81287
Malicious:	false
Preview:	jaraco.text-3.12.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..jaraco.text-3.12.1.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..jaraco.text-3.12.1.dist-info/METADATA,sha256=AzWdm6ViMfDOPoQMfLWn2zgBQSGJScyqeN29TcuWXVI,3658..jaraco.text-3.12.1.dist-info/RECORD,,..jaraco.text-3.12.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..jaraco.text-3.12.1.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..jaraco.text-3.12.1.dist-info/top_level.txt,sha256=0JnN3LfXH4LIRfXL-QFOGCJzQWZO3ELx4R1d_louoQM,7..jaraco/text/Lorem ipsum.txt,sha256=N_7c_79zxOufBY9HZ3yzMgOkNv-TkOTTio4BydrSjgs,1335..jaraco/text/__init__.py,sha256=Y2YUqXR_orUoDaY4SkPRe6ZZhb5HUHB_Ah9RCNsVyho,16250..jaraco/text/__pycache__/__init__.cpython-312.pyc,,..jaraco/text/__pycache__/layouts.cpython-312.pyc,,..jaraco/text/__pycache__/show-newlines.cpython-312.pyc,,..jaraco/text/__pycache__/strip-prefix.cpython-312.pyc,,..jaraco/text/__py

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.text-3.12.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco.text-3.12.1.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:GEG0:GEG0
MD5:	0BA8D736B7B4AB182687318B0497E61E
SHA1:	311BA5FFD098689179F299EF20768EE1A29F586D
SHA-256:	D099CDDCB7D71F82C845F5CBF9014E18227341664EDC42F1E11D5DFE5A2EA103
SHA-512:	7CCCBB4AFA2FADE40D529482301BEAE152E0C71EE3CC41736EB19E35CFC5EE3B91EF958CF5CA6B7330333B8494FEB6682FD833D5AA16BF4A8F1F721FD859832C
Malicious:	false
Preview:	jaraco.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text, with very long lines (888)
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.226823573023539
Encrypted:	false
SSDEEP:	24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
MD5:	4CE7501F6608F6CE4011D627979E1AE4
SHA1:	78363672264D9CD3F72D5C1D3665E1657B1A5071
SHA-256:	37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
SHA-512:	A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
Malicious:	false
Preview:	Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\more_itertools-10.3.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\more_itertools-10.3.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1053
Entropy (8bit):	5.0945274555157285
Encrypted:	false
SSDEEP:	24:arOJH7H0yxgtUHw1hC09QHOsUv4eOk4/+/m3oqLFh:aSJrlxEvdQHOs5exm3ogFh
MD5:	3396EA30F9D21389D7857719816F83B5
SHA1:	0D43A836DAC65C0EA426AD49C881A1086600BF85
SHA-256:	09F1C8C9E941AF3E584D59641EA9B87D83C0CB0FD007EB5EF391A7E2643C1A46
SHA-512:	D43092223392EDDA3BD777625F5BF54ACB0CC00C25555A4F8A16DB9CCDAFC380D3204486CB2A5FDC9D3F9E459B1FED948FFC7000AA0E40F37B807A01F4421294
Malicious:	false
Preview:	Copyright (c) 2012 Erik Rose..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies.of the Software, and to permit persons to whom the Software is furnished to do.so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECTION WITH THE SO

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\more_itertools-10.3.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	36293
Entropy (8bit):	3.717596190655759
Encrypted:	false
SSDEEP:	384:bs9cnyPtWIRmL0QnCHx4Zi3XBB9GcF89oi+odVBqCv9d3m24TeYH5AvDpG27IFf5:Ua+H1Nsg/
MD5:	5BA05B51B603386707E1E3A101CDD6B3
SHA1:	FFCCEC7FD799CC4AB07530954FEF3BE2472E2C23
SHA-256:	0453BDD0EF9F2CD89540CA63EE8212E73B73809514419DD3037D8FE471F737E0
SHA-512:	FE7F7D6B6C8089B09A18930EF462BA4C7A15EAF6D3E8610AC655ECADE16CE31D9C01ECE84C88A3C2D9DD34DE70E194A020E28179CF33B21389EE3EEFC7229B74
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: more-itertools.Version: 10.3.0.Summary: More routines for operating on iterables, beyond itertools.Keywords: itertools,iterator,iteration,filter,peek,peekable,chunk,chunked.Author-email: Erik Rose <erikrose@grinchcentral.com>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Natural Language :: English.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation :: Py

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\more_itertools-10.3.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1259
Entropy (8bit):	5.794423512787632
Encrypted:	false
SSDEEP:	24:Bhxn/2zDahxvIhxphxBhxEsJXhxzvXiCflBJRHXoggtqgmf7WJhmsxmwG:hnuXwOph5J3zvXi4Lo7qgQ7WJhS
MD5:	178EE325409DD28809AD3661E8819EF8
SHA1:	F5844FAC6E3C9133FE5F1B8195EE801959801DF3
SHA-256:	77C8E73E018DC0FD7E9ED6C80B05A4404545F641FB085220CE42B368B59AA3D3
SHA-512:	2DB06B622F644674BF7D7AD8B780F9802858D15D73B5075139C2D82181DD6D589B90172BCA7AE9C785E705F447F523DB2AE641826C550C599551A7D8C2396FC2
Malicious:	false
Preview:	more_itertools-10.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..more_itertools-10.3.0.dist-info/LICENSE,sha256=CfHIyelBrz5YTVlkHqm4fYPAyw_QB-te85Gn4mQ8GkY,1053..more_itertools-10.3.0.dist-info/METADATA,sha256=BFO90O-fLNiVQMpj7oIS5ztzgJUUQZ3TA32P5HH3N-A,36293..more_itertools-10.3.0.dist-info/RECORD,,..more_itertools-10.3.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..more_itertools-10.3.0.dist-info/WHEEL,sha256=rSgq_JpHF9fHR1lx53qwg_1-2LypZE_qmcuXbVUq948,81..more_itertools/__init__.py,sha256=dtAbGjTDmn_ghiU5YXfhyDy0phAlXVdt5klZA5fUa-Q,149..more_itertools/__init__.pyi,sha256=5B3eTzON1BBuOLob1vCflyEb2lSd6usXQQ-Cv-hXkeA,43..more_itertools/__pycache__/__init__.cpython-312.pyc,,..more_itertools/__pycache__/more.cpython-312.pyc,,..more_itertools/__pycache__/recipes.cpython-312.pyc,,..more_itertools/more.py,sha256=1E5kzFncRKTDw0cYv1yRXMgDdunstLQd1QStcnL6U90,148370..more_itertools/more.pyi,sha256=iXXeqt48Nxe8VGmIWpkVXuKpR2FYNuu2DU8nQL

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\more_itertools-10.3.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFML6KjP+tPCCfA5I:Rt1QqL6gWBB3
MD5:	FE76A5D309B5416824C2034FBF8A16CD
SHA1:	5975EB6043863B0D018A5D751293F38E0B8E2874
SHA-256:	AD282AFC9A4717D7C7475971E77AB083FD7ED8BCA9644FEA99CB976D552AF78F
SHA-512:	6E4610171DD4E7E49FB4570CF3562D26A4F171FF67DA0F3A259A77916ACB939C8FCA7DA9F473EFAD839947796AC8CD7385DAA3264ADB150FF131A5C0FAC9329C
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.8.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\packaging-24.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\packaging-24.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.510719529760597
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreBNA2eBKmJozlMHuO:h9Co8FyQjkDYc5tWreBN0n2mH1
MD5:	FAADAEDCA9251A90B205C9167578CE91
SHA1:	ED1FCABA1DBBF55113ABB419A484F3DF63E7ECFC
SHA-256:	CAD1EF5BD340D73E074BA614D26F7DEACA5C7940C3D8C34852E65C4909686C48
SHA-512:	1E69C89558FFE39E5C1EBB6728C4F0EB6023563C7A7F31B5417A8EFCC906378D2E2AF7B0E06A66980FBAAB7996AEB2AE1EA3918FDBE5FFCC3F77EA888A68EFBC
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to this software is made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\packaging-24.1.dist-info\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10174
Entropy (8bit):	4.3908324771089084
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:U9vlKM1zJlFvmNz5VrZ
MD5:	2EE41112A44FE7014DCE33E26468BA93
SHA1:	598F87F072F66E2269DD6919292B2934DBB20492
SHA-256:	0D542E0C8804E39AA7F37EB00DA5A762149DC682D7829451287E11B938E94594
SHA-512:	27B8C0252EAE50CA3CE02AB7C5670664C0C824E03EB3DA1089F3F0A00D23E648A956BCB9F53645C6D79674A87C4CC86D1085DC335911BE0210D691336B121857
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\packaging-24.1.dist-info\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1344
Entropy (8bit):	5.070827944686827
Encrypted:	false
SSDEEP:	24:fjUnoorbOFFTJJyRrYFTjz796432s4EOkUs8gROF32s3yTtTf413tf9fsZlTHv:fkOFJSrYJR6432svI32s3Stc13tfyTHv
MD5:	7BEF9BF4A8E4263634D0597E7BA100B8
SHA1:	FDC0E4EABC45522B079DEFF7D03D70528D775DC0
SHA-256:	B70E7E9B742F1CC6F948B34C16AA39FFECE94196364BC88FF0D2180F0028FAC5
SHA-512:	96C3273D51B83B6AE1AB85FEFB814DCD6C1E60D311D412242405AA429CC860412477CBD6ECE171408DBB85F0C4FD742E3AF20C758015BC48406AA65A1AB6F60A
Malicious:	false
Preview:	Copyright (c) Donald Stufft and individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE.DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE.FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL.DAMAGES (INCLUDING, BUT NOT LIM

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\packaging-24.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3204
Entropy (8bit):	4.9859857663557925
Encrypted:	false
SSDEEP:	96:DRKnOkaMktjaVMxsxCp5QXFfFKiYEvA9TzBnyD:psZfFhgXNG
MD5:	3236C0D7091D4A6577FA30E061480CEC
SHA1:	F99865B8D3B90AD64A0060F7F2F4C6E4FAEB0A39
SHA-256:	5F7A283B75A709FCCD481AEA42379F083D4F3801753365922E6B0732042515D9
SHA-512:	A9F0BC43A135732510B98E9C0B7F997D9557A6069352372F1AC3216F0E66FA617D9597990904935D58E5139FB34E17995BFA8B95B90C71997206A2B6955FE867
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: packaging.Version: 24.1.Summary: Core utilities for Python packages.Author-email: Donald Stufft <donald@stufft.io>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Language :: Python :: 3.13.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\packaging-24.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2565
Entropy (8bit):	5.780503861671858
Encrypted:	false
SSDEEP:	48:bsnuXksXW2Bsv8VsQ7lEsahOsbs5Jhsde8UogvtJkHpHAfEcysrD5WJeCzESowj:vXrW2s8JsMdVogvtJkJgfksP5qeCzOwj
MD5:	88FBF3C6BD08040482212DAD5A8EAB02
SHA1:	E7EE66942F7321FB77888D492D57C2EEEA1A5171
SHA-256:	38A6898306293627C81E2B2D8A93E5F6857D5F7EDB73F0334E8D9A53DAD53B6E
SHA-512:	786AE1F883A999A0939C22A756F90D74CC7F87AAF13F6FFF22D8D962D213A1ECBC6AAE2890A5D7347487824CD0E9EB440A3923F01F938EEF068719DFEEE96554
Malicious:	false
Preview:	packaging-24.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..packaging-24.1.dist-info/LICENSE,sha256=ytHvW9NA1z4HS6YU0m996spceUDD2MNIUuZcSQlobEg,197..packaging-24.1.dist-info/LICENSE.APACHE,sha256=DVQuDIgE45qn836wDaWnYhSdxoLXgpRRKH4RuTjpRZQ,10174..packaging-24.1.dist-info/LICENSE.BSD,sha256=tw5-m3QvHMb5SLNMFqo5_-zpQZY2S8iP8NIYDwAo-sU,1344..packaging-24.1.dist-info/METADATA,sha256=X3ooO3WnCfzNSBrqQjefCD1POAF1M2WSLmsHMgQlFdk,3204..packaging-24.1.dist-info/RECORD,,..packaging-24.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..packaging-24.1.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..packaging/__init__.py,sha256=dtw2bNmWCQ9WnMoK3bk_elL1svSlikXtLpZhCFIB9SE,496..packaging/__pycache__/__init__.cpython-312.pyc,,..packaging/__pycache__/_elffile.cpython-312.pyc,,..packaging/__pycache__/_manylinux.cpython-312.pyc,,..packaging/__pycache__/_musllinux.cpython-312.pyc,,..packaging/__pycache__/_parser.cpython-312.pyc,,

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\packaging-24.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\platformdirs-4.2.2.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\platformdirs-4.2.2.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11429
Entropy (8bit):	5.039575520713946
Encrypted:	false
SSDEEP:	192:n9x/tlCtlsaCUpVQ7yHwgNF8NFvWVDM1RnzadSibNTTh+fOnnxa6jlES4h8a8KAH:3/tlCfsqpq7ydZzM0dGiCbvHcjNj61TA
MD5:	12306075DF09A0DBB93315FADDDF73FB
SHA1:	1AC8A3679AFCFEEC0BA00851F5F8095DD1B060CD
SHA-256:	CE6B227B4D46D4CB57474C2022FE57A557933BB89DAF4596BDF9B12AC296B869
SHA-512:	BA0A72B888A14F82FD44FB103C01EF0900B5302F18E986A8264A9A08AB77D1C655C392374FD7B0A98BEF9B9511F6EC78AF3EF8936091C80A0B5364F7A53DC20A
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: platformdirs.Version: 4.2.2.Summary: A small Python package for determining appropriate platform-specific dirs, e.g. a `user data dir`..Project-URL: Documentation, https://platformdirs.readthedocs.io.Project-URL: Homepage, https://github.com/platformdirs/platformdirs.Project-URL: Source, https://github.com/platformdirs/platformdirs.Project-URL: Tracker, https://github.com/platformdirs/platformdirs/issues.Maintainer-email: Bern.t G.bor <gaborjbernat@gmail.com>, Julian Berman <Julian@GrayVines.com>, Ofek Lev <oss@ofek.dev>, Ronny Pfannschmidt <opensource@ronnypfannschmidt.de>.License-Expression: MIT.License-File: LICENSE.Keywords: appdirs,application,cache,directory,log,user.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\platformdirs-4.2.2.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.780720255872038
Encrypted:	false
SSDEEP:	24:bn/2zDzoobEsJhfPWcs013+pj456szN6lnhta57WJ+guQg4:bnuXcob5Jhfucs+d49hta9WJ+g1X
MD5:	0E141A28570FC62974FC5CEADFE808E3
SHA1:	7B92561C5BBBA83D6E16A1C7B195089ACA1766AF
SHA-256:	4C211D76D42ED40EFC3ACFCC866D8912A718AFBCA2B7E51849442366D6E99FE8
SHA-512:	830721C18A35AECD1EFB81A5FAAF8AC0EA02428EDC5B294458556343788D894B76035F1E661214D975DF2A64DC8C3D6AAA7A53A99BE64B9413B6A5D89D549F9D
Malicious:	false
Preview:	platformdirs-4.2.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..platformdirs-4.2.2.dist-info/METADATA,sha256=zmsie01G1MtXR0wgIv5XpVeTO7idr0WWvfmxKsKWuGk,11429..platformdirs-4.2.2.dist-info/RECORD,,..platformdirs-4.2.2.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..platformdirs-4.2.2.dist-info/WHEEL,sha256=zEMcRr9Kr03x1ozGwg5v9NQBKn3kndp6LSoSlVg-jhU,87..platformdirs-4.2.2.dist-info/licenses/LICENSE,sha256=KeD9YukphQ6G6yjD_czwzv30-pSHkBHP-z0NS-1tTbY,1089..platformdirs/__init__.py,sha256=EMGE8qeHRR9CzDFr8kL3tA8hdZZniYjXBVZd0UGTWK0,22225..platformdirs/__main__.py,sha256=HnsUQHpiBaiTxwcmwVw-nFaPdVNZtQIdi1eWDtI-MzI,1493..platformdirs/__pycache__/__init__.cpython-312.pyc,,..platformdirs/__pycache__/__main__.cpython-312.pyc,,..platformdirs/__pycache__/android.cpython-312.pyc,,..platformdirs/__pycache__/api.cpython-312.pyc,,..platformdirs/__pycache__/macos.cpython-312.pyc,,..platformdirs/__pycache__/unix.cpython-312.pyc,,..platformdirs/__p

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\platformdirs-4.2.2.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.730668933656452
Encrypted:	false
SSDEEP:	3:RtEeXAaCTR73RP+tPCCfA5I:Rt2PFRWBB3
MD5:	8895639B8515B3094302B59E28AFB562
SHA1:	FBD4DA759EA5BEB65AE820DFBC47F9B569E89519
SHA-256:	CC431C46BF4AAF4DF1D68CC6C20E6FF4D4012A7DE49DDA7A2D2A1295583E8E15
SHA-512:	B53C0978DAD2A7195058ABC7B7D20A229EC617BDDBB364D8ED2354F37D5071208735774350F9FBBA5C804BEFCEFE71C27BC5E468E12899DF4687189C468785A0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: hatchling 1.24.2.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\platformdirs-4.2.2.dist-info\licenses\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	5.119723466133474
Encrypted:	false
SSDEEP:	24:VrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:VaJHlxE3dQHOs5exm3ogFh
MD5:	EA4F5A41454746A9ED111E3D8723D17A
SHA1:	F511A8A63AF8C6E36004B593478436BBC560EE0C
SHA-256:	29E0FD62E929850E86EB28C3FDCCF0CEFDF4FA94879011CFFB3D0D4BED6D4DB6
SHA-512:	CACA68A5589CA2EAB7C0D74BA5D2B25E3367B9902DFC7578BBA911AC8F8BF1C3A13F25E663C5B6B19BA71BF611943E23F4D0A99BE92A8F7D7FF60732DC3DD409
Malicious:	false
Preview:	MIT License..Copyright (c) 2010-202x The platformdirs developers..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\tomli-2.0.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\tomli-2.0.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1072
Entropy (8bit):	5.10135495500641
Encrypted:	false
SSDEEP:	24:f9rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:1aJHlxE3dQHOs5exm3ogFh
MD5:	AAAAF0879D17DF0110D1AA8C8C9F46F5
SHA1:	9DA6CA26337A886FB3E8D30EFD4AEDA623DC9ADE
SHA-256:	B80816B0D530B8ACCB4C2211783790984A6E3B61922C2B5EE92F3372AB2742FE
SHA-512:	EECD0C29FEBF51ADEFB02F970E66EFE7E24D573686DFDB3BEEA63CEFEA012A79CE3C49A899B4F26E9B67DC27176B397F6041909227281F9866BEEDC97389095C
Malicious:	false
Preview:	MIT License..Copyright (c) 2021 Taneli Hukkinen..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CON

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\tomli-2.0.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8875
Entropy (8bit):	4.884349533695185
Encrypted:	false
SSDEEP:	192:h15VsahrDzoGlmLxUJyLIPXR/yrKK3Trclclg2pj4VRR6V8wNVonQd:3swrAamWuIPA2K3v2g
MD5:	CBBF7047A51FEDA58386E86182B85B8A
SHA1:	D3EA3BDA227794AE35FE7FFC5BD6E5FA2A5EF250
SHA-256:	CCF0DC78A98FC0918B5AD67292B1E2C4BED65575A6246CD9D63C914F9942A0F2
SHA-512:	A994914F1676790730C6BDACA26FE5F1B18BA9A3B9F0D24D708C722424DED255360A0CC88E239C6BFE467BD2763DF7339BB6B760AB090FAE474A7C9C8AFA8948
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: tomli.Version: 2.0.1.Summary: A lil' TOML parser.Keywords: toml.Author-email: Taneli Hukkinen <hukkin@users.noreply.github.com>.Requires-Python: >=3.7.Description-Content-Type: text/markdown.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: MacOS.Classifier: Operating System :: Microsoft :: Windows.Classifier: Operating System :: POSIX :: Linux.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation :: PyPy.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Typing :: Typed.Project-URL: Changelog, https://github.com/hukkin/tomli/blob/master/CHANGELOG.md.Project-URL:

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\tomli-2.0.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	999
Entropy (8bit):	5.89030761653127
Encrypted:	false
SSDEEP:	24:4n/2zDRv53Pb4EsJWc6QtD8r8N8bh8WNdop2+oM8+kzAL5+1:4nuXR1Pb45JWc6QmIebKWcpHoM8JMLy
MD5:	D5FAB61E3DB6B54B51FBA607865C195B
SHA1:	B94D9126E8FC9D5F29FAFBB67F068E2D111D17FC
SHA-256:	0CB9F9A451A1E365AC54B4C88662E1DA0CB54A72D16A5258FB0ABFF9D3E1C022
SHA-512:	ABD3EF61D8D578C1DE609560A6985503E60BD53F90DCFF54EBEE23714D9CD88DBA4036ED19B24EC62B8432550311894FCC47BDCCD7CE4DCDE82518F4E02E123C
Malicious:	false
Preview:	tomli-2.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..tomli-2.0.1.dist-info/LICENSE,sha256=uAgWsNUwuKzLTCIReDeQmEpuO2GSLCte6S8zcqsnQv4,1072..tomli-2.0.1.dist-info/METADATA,sha256=zPDceKmPwJGLWtZykrHixL7WVXWmJGzZ1jyRT5lCoPI,8875..tomli-2.0.1.dist-info/RECORD,,..tomli-2.0.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..tomli-2.0.1.dist-info/WHEEL,sha256=jPMR_Dzkc4X4icQtmz81lnNY_kAsfog7ry7qoRvYLXw,81..tomli/__init__.py,sha256=JhUwV66DB1g4Hvt1UQCVMdfCu-IgAV8FXmvDU9onxd4,396..tomli/__pycache__/__init__.cpython-312.pyc,,..tomli/__pycache__/_parser.cpython-312.pyc,,..tomli/__pycache__/_re.cpython-312.pyc,,..tomli/__pycache__/_types.cpython-312.pyc,,..tomli/_parser.py,sha256=g9-ENaALS-B8dokYpCuzUFalWlog7T-SIYMjLZSWrtM,22633..tomli/_re.py,sha256=dbjg5ChZT23Ka9z9DHOXfdtSpPwUfdgMXnj8NOoly-w,2943..tomli/_types.py,sha256=-GTG2VUqkpxwMqzmVO4F7ybKddIbAnuAHXfmWQcTi3Q,254..tomli/py.typed,sha256=8PjyZ1aVoQpRVvt71muvuq5qE-jTFZkK-GLHkhdebmc,26..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\tomli-2.0.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFMthP+tPCCfA5I:Rt1QqDWBB3
MD5:	FF39892A240316BD62B5832C03D504BC
SHA1:	3883FC4406CC9A73BE0B839C1A0C31D3DDD64829
SHA-256:	8CF311FC3CE47385F889C42D9B3F35967358FE402C7E883BAF2EEAA11BD82D7C
SHA-512:	B2E57D9C81BBFB7364B8216FC086B8F73C2F2B537E300FB250EFB7972E3908F77A3D504363676C50A195D307822C69EE9B689DE6C48A4E6B8A6BA89A5A99AC32
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.6.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typeguard-4.3.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typeguard-4.3.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1130
Entropy (8bit):	5.118590213496374
Encrypted:	false
SSDEEP:	24:qt4rWHvH0yPP3Gt6Hw1hP9QHmsUv48OV/+dho3BoqxFB:/S/lPvKhlQHms5QK3WmFB
MD5:	F0E423EEA5C91E7AA21BDB70184B3E53
SHA1:	A51CCDCB7A9D8C2116D1DFC16F11B3C8A5830F67
SHA-256:	6163F7987DFB38D6BC320CE2B70B2F02B862BC41126516D552EF1CD43247E758
SHA-512:	8BE742880E6E8495C7EC4C9ECC8F076A9FC9D64FC84B3AEBBC8D2D10DC62AC2C5053F33B716212DCB76C886A9C51619F262C460FC4B39A335CE1AE2C9A8769A8
Malicious:	false
Preview:	This is the MIT license: http://www.opensource.org/licenses/mit-license.php..Copyright (c) Alex Gr.nholm..Permission is hereby granted, free of charge, to any person obtaining a copy of this.software and associated documentation files (the "Software"), to deal in the Software.without restriction, including without limitation the rights to use, copy, modify, merge,.publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons.to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or.substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,.INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR.PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE.FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF C

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typeguard-4.3.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3717
Entropy (8bit):	4.986068381037722
Encrypted:	false
SSDEEP:	96:DSQRbraktjaAckH94jQnJIK04Fak/grjspC3EklAJj:/Rakd4jA7ak/gvspNWmj
MD5:	B6DAAC02F66AC8403E9061881322BABE
SHA1:	9A94672CCFEA06156A5F8A321CD0626CFD233AE8
SHA-256:	CF675C1C0A744F08580855390DE87CC77D676B312582E8D4CFDB5BB8FD298D21
SHA-512:	9C6B7326C90396AA9E962C2731A1085EDB672B5696F95F552D13350843C09A246E0BBF0EC484862DFF434FA5A86DE4C0B7C963958ADE35A066B9D2384076DD47
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: typeguard.Version: 4.3.0.Summary: Run-time type checker for Python.Author-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.License: MIT.Project-URL: Documentation, https://typeguard.readthedocs.io/en/latest/.Project-URL: Change log, https://typeguard.readthedocs.io/en/latest/versionhistory.html.Project-URL: Source code, https://github.com/agronholm/typeguard.Project-URL: Issue tracker, https://github.com/agronholm/typeguard/issues.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Python: >=3.8.Description-Content

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typeguard-4.3.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2402
Entropy (8bit):	5.729208478282605
Encrypted:	false
SSDEEP:	48:eDnuX3DVED9HDDeDfPDLkAosGDlDiVoBFj7XH0H3HuwVB6Kgfkx7J/Q1NK1cQyxk:eyX3WRHDiLPjksV7I47J/Q1U6Qyx5fsJ
MD5:	D680B2881597974ACD91750E5AB61010
SHA1:	E00ED2416B5CE21641E3946905504D62D536972F
SHA-256:	48A51959582478352275428CEECD78EF77D79AC9DAE796E39A2EAF2540282552
SHA-512:	112172ACB515B0712AC58D78898EB159580ADA3DD3F16AABB37CB7A8D964F9E4BADF2869A245927B83B208D56904831C0F04ED925C95DFCB705801734FB0C7BA
Malicious:	false
Preview:	typeguard-4.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..typeguard-4.3.0.dist-info/LICENSE,sha256=YWP3mH37ONa8MgzitwsvArhivEESZRbVUu8c1DJH51g,1130..typeguard-4.3.0.dist-info/METADATA,sha256=z2dcHAp0TwhYCFU5Deh8x31nazElgujUz9tbuP0pjSE,3717..typeguard-4.3.0.dist-info/RECORD,,..typeguard-4.3.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..typeguard-4.3.0.dist-info/entry_points.txt,sha256=qp7NQ1aLtiSgMQqo6gWlfGpy0IIXzoMJmeQTLpzqFZQ,48..typeguard-4.3.0.dist-info/top_level.txt,sha256=4z28AhuDodwRS_c1J_l8H51t5QuwfTseskYzlxp6grs,10..typeguard/__init__.py,sha256=Onh4w38elPCjtlcU3JY9k3h70NjsxXIkAflmQn-Z0FY,2071..typeguard/__pycache__/__init__.cpython-312.pyc,,..typeguard/__pycache__/_checkers.cpython-312.pyc,,..typeguard/__pycache__/_config.cpython-312.pyc,,..typeguard/__pycache__/_decorators.cpython-312.pyc,,..typeguard/__pycache__/_exceptions.cpython-312.pyc,,..typeguard/__pycache__/_functions.cpython-312.pyc,,..typeguard/__pycache__/_i

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typeguard-4.3.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typeguard-4.3.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.155187698990101
Encrypted:	false
SSDEEP:	3:mWSJCQEjMitjHfLvn:mrMJHfbn
MD5:	AEAB5BCF8BF89A51C97C4CDF70578848
SHA1:	2E9C1617560AB66431AAB90700DB901985293485
SHA-256:	AA9ECD43568BB624A0310AA8EA05A57C6A72D08217CE830999E4132E9CEA1594
SHA-512:	2BE73E99296DF26A28835F91DD8BC50EB104AF06A3C54666175FAF322E0AD4620453DB0388531C4113B052A92C1D2E4C3088E25AF43CDE42AA852CF7B0CB5B05
Malicious:	false
Preview:	[pytest11].typeguard = typeguard._pytest_plugin.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typeguard-4.3.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:LEJn:M
MD5:	004A2A8CE1AB120A63902A27D76BD964
SHA1:	A4E367AB40410598DADD1FC5F680ED7A176BEB09
SHA-256:	E33DBC021B83A1DC114BF73527F97C1F9D6DE50BB07D3B1EB24633971A7A82BB
SHA-512:	0D8FF9A43897AB390AB41AFE5BAC8BD38A68C2BEF88E844E5B49BF70E3164B226975CC2717AE3DC3428D1CFBB0BE068C243F104915FEE1FFA58C23FBE76FDB89
Malicious:	false
Preview:	typeguard.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typing_extensions-4.12.2.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typing_extensions-4.12.2.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13936
Entropy (8bit):	5.135214154002924
Encrypted:	false
SSDEEP:	384:cke8RQ6KSAdxC9ad9iqsibQtKti9zpQpzu9Jkh:K8RQ6q7C9ad9iqT8cti9zpQpzu7kh
MD5:	FCF6B249C2641540219A727F35D8D2C2
SHA1:	C6E195F9AA30CC9B675D1612CA4FB7F74111BD35
SHA-256:	3B2F81FE21D181C499C59A256C8E1968455D6689D269AA85373BFB6AF41DA3BF
SHA-512:	70367B908204B5922E5D9D2ACE39437DBAA1EEFDAD1797B50CC6E7DCA168D9B59199353BADDDCAEEE12B49D328FC8132F628952383CFE6803CB4F4BF9B9D6D86
Malicious:	false
Preview:	A. HISTORY OF THE SOFTWARE.==========================..Python was created in the early 1990s by Guido van Rossum at Stichting.Mathematisch Centrum (CWI, see https://www.cwi.nl) in the Netherlands.as a successor of a language called ABC. Guido remains Python's.principal author, although it includes many contributions from others...In 1995, Guido continued his work on Python at the Corporation for.National Research Initiatives (CNRI, see https://www.cnri.reston.va.us).in Reston, Virginia where he released several versions of the.software...In May 2000, Guido and the Python core development team moved to.BeOpen.com to form the BeOpen PythonLabs team. In October of the same.year, the PythonLabs team moved to Digital Creations, which became.Zope Corporation. In 2001, the Python Software Foundation (PSF, see.https://www.python.org/psf/) was formed, a non-profit organization.created specifically to own Python-related Intellectual Property..Zope Corporation was a sponsoring member of the PS

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typing_extensions-4.12.2.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	5.0579916471633
Encrypted:	false
SSDEEP:	48:DtkCMU2ymXbFX1QI/aMktjaVQEBu+FOK+W6i+qXd0qme28mIp9DvvV+Vz+nlh:DtkCD/mxX1QI/aMktjaVBroBBqd0VODD
MD5:	8303191AC93E4D32457A4A9E3CDAD8E5
SHA1:	B6ADA54B9516D20B69A5DD5CDED868DA22C5E252
SHA-256:	05E51021AF1C9D86EB8D6C7E37C4CECE733D5065B91A6D8389C5690ED440F16D
SHA-512:	F2F5DBE5EA55ED720FA4191180076E9EFFCB9C811C3C7BF1A1201E9D78590B381E125EAF7B8366B28A03383C2958449423548576605E8DCB5CC11C33C9B0E709
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: typing_extensions.Version: 4.12.2.Summary: Backported and Experimental Type Hints for Python 3.8+.Keywords: annotations,backport,checker,checking,function,hinting,hints,type,typechecking,typehinting,typehints,typing.Author-email: "Guido van Rossum, Jukka Lehtosalo, .ukasz Langa, Michael Lee" <levkivskyi@gmail.com>.Requires-Python: >=3.8.Description-Content-Type: text/markdown.Classifier: Development Status :: 5 - Production/Stable.Classifier: Environment :: Console.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Python Software Foundation License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Langua

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typing_extensions-4.12.2.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	571
Entropy (8bit):	5.751670348693122
Encrypted:	false
SSDEEP:	12:rCA89x0a/2zDuxv/vjWaxLbSaLjxjxXaefIE12BATqyo/C:mA87n/2zD6vXCulVZf5Cc4C
MD5:	B884E8832BFB336C2D7F54271F11EE1C
SHA1:	5A3BAABEE79E0CF32D2E87C9AF0FBB3AAD8CACAD
SHA-256:	7710002D81971E632AA6A2FC33DC5D74AAF5D7CAAE22040A65D3E31503B05EE9
SHA-512:	0A5EB3ABED212C474CB5FDDEF47F8E62DAA130128F2BB368A8E1F12E143DAE2F8B2EF4A9B85A883A03C67195829AD637DB7CF7CC4B41535AF6CA5668F8F2BD0B
Malicious:	false
Preview:	__pycache__/typing_extensions.cpython-312.pyc,,..typing_extensions-4.12.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..typing_extensions-4.12.2.dist-info/LICENSE,sha256=Oy-B_iHRgcSZxZolbI4ZaEVdZonSaaqFNzv7avQdo78,13936..typing_extensions-4.12.2.dist-info/METADATA,sha256=BeUQIa8cnYbrjWx-N8TOznM9UGW5Gm2DicVpDtRA8W0,3018..typing_extensions-4.12.2.dist-info/RECORD,,..typing_extensions-4.12.2.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..typing_extensions.py,sha256=gwekpyG9DVG3lxWKX4ni8u7nk3We5slG98mA9F3DJQw,134451..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\typing_extensions-4.12.2.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.115074330424529
Encrypted:	false
SSDEEP:	24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
MD5:	7FFB0DB04527CFE380E4F2726BD05EBF
SHA1:	5B39C45A91A556E5F1599604F1799E4027FA0E60
SHA-256:	30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
SHA-512:	205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
Malicious:	false
Preview:	MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.088249746074878
Encrypted:	false
SSDEEP:	48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
MD5:	EBEA27DA14E3F453119DC72D84343E8C
SHA1:	7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
SHA-256:	59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
SHA-512:	A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	5.714200636114494
Encrypted:	false
SSDEEP:	96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
MD5:	44D352C4997560C7BFB82D9360F5985A
SHA1:	BE58C7B8AB32790384E4E4F20865C4A88414B67A
SHA-256:	783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
SHA-512:	281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
Malicious:	false
Preview:	../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.271713330022269
Encrypted:	false
SSDEEP:	3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
MD5:	6180E17C30BAE5B30DB371793FCE0085
SHA1:	E3A12C421562A77D90A13D8539A3A0F4D3228359
SHA-256:	AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
SHA-512:	69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
Malicious:	false
Preview:	[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\zipp-3.19.2.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\zipp-3.19.2.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\zipp-3.19.2.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3575
Entropy (8bit):	5.085545958857746
Encrypted:	false
SSDEEP:	96:D0h4aC/S802Vpnu3pyt1Q+/+DeVb0ksYSwTgD:Oc/z02Vpnu3pytS+2DeVNfSwTW
MD5:	F659E7F578CE6FD3753871DBBBA1F939
SHA1:	C53B0E6A2E3D94093E2FE4978926A7439B47D43C
SHA-256:	508AE4FE43081C64B0B0A2828588B3A8CC3430C6693D1676662569400B0DFDB1
SHA-512:	2C0496B76D259259A8F1E57F3ED2224A7E3E99FF309F764C00A8377BB5BD1C94035BDDF24BD1BA637209677CB9F4E8109F84C50B3488B5B8FC372B6BEDAB9AE0
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: zipp.Version: 3.19.2.Summary: Backport of pathlib-compatible object wrapper for zip files.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/zipp.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: test.Requires-Dist: pytest !=8.1.*,>=6 ; extra == 'test'.Requires-Dist: pytest-checkdocs >=2.4 ; extra == 'test'.Requir

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\zipp-3.19.2.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.8094923667268965
Encrypted:	false
SSDEEP:	24:An/2zDlvbqfuiwbWk/EsJ6Xam9lpW8OWq3tW36nJA3u3iWwksYW:AnuXlzUuitk/5J6f9lpW8OW4tM6nJSkE
MD5:	1E77310EF3277C93430D969FEAC8FDFC
SHA1:	173240337F249E2A6D54206AA0D0ACB0FDED12D7
SHA-256:	F316F2E03FD9ADE7EBBC0B154706848E2BB8FD568B90935109F0D8E3CE2B9BFE
SHA-512:	68F752DAF2DBEB79644337E4DB9B8CEAEAE3606A865EDC32BE16785DC97BDCF38EF200F0EDC86DC9D71ABA72E108D2851A510F0EB598FFEA286503F0C9772E5E
Malicious:	false
Preview:	zipp-3.19.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..zipp-3.19.2.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..zipp-3.19.2.dist-info/METADATA,sha256=UIrk_kMIHGSwsKKChYizqMw0MMZpPRZ2ZiVpQAsN_bE,3575..zipp-3.19.2.dist-info/RECORD,,..zipp-3.19.2.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..zipp-3.19.2.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..zipp-3.19.2.dist-info/top_level.txt,sha256=iAbdoSHfaGqBfVb2XuR9JqSQHCoOsOtG6y9C_LSpqFw,5..zipp/__init__.py,sha256=QuI1g00G4fRAcGt-HqbV0oWIkmSgedCGGYsHHYzNa8A,13412..zipp/__pycache__/__init__.cpython-312.pyc,,..zipp/__pycache__/glob.cpython-312.pyc,,..zipp/compat/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..zipp/compat/__pycache__/__init__.cpython-312.pyc,,..zipp/compat/__pycache__/py310.cpython-312.pyc,,..zipp/compat/py310.py,sha256=eZpkW0zRtunkhEh8jjX3gCGe22emoKCBJw72Zt4RkhA,219..zipp/glob.py,sha256=etWpnfEoRyf

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\zipp-3.19.2.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI59722\setuptools\_vendor\zipp-3.19.2.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:m:m
MD5:	9B929466EC7848714DE24BCF75AE57CB
SHA1:	ECC9237295CDA9B690BE094E58FAE1458A4B0389
SHA-256:	8806DDA121DF686A817D56F65EE47D26A4901C2A0EB0EB46EB2F42FCB4A9A85C
SHA-512:	C8D8967BE2B5094A5D72BA4BEF5DBDA2CBF539BF3B8B916CF86854087A12DF82B51B7BF5B6EFA79898692EFD22FAD9688058448CAAB198FB708A0E661DC685EA
Malicious:	false
Preview:	zipp.

C:\Users\user\AppData\Local\Temp\_MEI59722\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1540376
Entropy (8bit):	6.5773187542887905
Encrypted:	false
SSDEEP:	24576:ImKZpHTv4iPI9FDgJNRs++l8GwLXSz4ih5Z5jWbsxuIl40OwumzuLgIhik:orJoDgJNRs+U8GwLXSMIZ5jWb0uIl48I
MD5:	8C5644CB9CEF2BB0702A4C8007521C98
SHA1:	638AF7D40162853D1BE85C04125DBF18743BFA1B
SHA-256:	2F9C9940E87840FF1B5C4922D8B73C7302D1B12BADC860990DFEBDF77B4140EE
SHA-512:	1F0A6E969BCB37BCD131B1476F21A068F69B9224063E194B3A04A9454E50DD530D3474E82B24A9BE727B94272FADFEAEA76A896CD0FB579E15FDF7A48B00CC01
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......gsX.#.6.#.6.#.6.*j../.6.3.7.!.6.3.5.'.6.3.2.+.6.3.3...6.hj7. .6.#.7...6.k.>.".6.k.6.".6.k..".6.k.4.".6.Rich#.6.........................PE..d....g.f.........." ...).0...(....................................................... ....`..............................................#...........`...............R.../...p..X...0...T..............................@............@..X............................text...9........0.................. ..`.rdata..,....@.......4..............@..@.data...`M...0...D..................@....pdata...............\..............@..@.rsrc........`.......8..............@..@.reloc..X....p.......B..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\typeguard-4.3.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\typeguard-4.3.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1130
Entropy (8bit):	5.118590213496374
Encrypted:	false
SSDEEP:	24:qt4rWHvH0yPP3Gt6Hw1hP9QHmsUv48OV/+dho3BoqxFB:/S/lPvKhlQHms5QK3WmFB
MD5:	F0E423EEA5C91E7AA21BDB70184B3E53
SHA1:	A51CCDCB7A9D8C2116D1DFC16F11B3C8A5830F67
SHA-256:	6163F7987DFB38D6BC320CE2B70B2F02B862BC41126516D552EF1CD43247E758
SHA-512:	8BE742880E6E8495C7EC4C9ECC8F076A9FC9D64FC84B3AEBBC8D2D10DC62AC2C5053F33B716212DCB76C886A9C51619F262C460FC4B39A335CE1AE2C9A8769A8
Malicious:	false
Preview:	This is the MIT license: http://www.opensource.org/licenses/mit-license.php..Copyright (c) Alex Gr.nholm..Permission is hereby granted, free of charge, to any person obtaining a copy of this.software and associated documentation files (the "Software"), to deal in the Software.without restriction, including without limitation the rights to use, copy, modify, merge,.publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons.to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or.substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,.INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR.PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE.FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF C

C:\Users\user\AppData\Local\Temp\_MEI59722\typeguard-4.3.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3717
Entropy (8bit):	4.986068381037722
Encrypted:	false
SSDEEP:	96:DSQRbraktjaAckH94jQnJIK04Fak/grjspC3EklAJj:/Rakd4jA7ak/gvspNWmj
MD5:	B6DAAC02F66AC8403E9061881322BABE
SHA1:	9A94672CCFEA06156A5F8A321CD0626CFD233AE8
SHA-256:	CF675C1C0A744F08580855390DE87CC77D676B312582E8D4CFDB5BB8FD298D21
SHA-512:	9C6B7326C90396AA9E962C2731A1085EDB672B5696F95F552D13350843C09A246E0BBF0EC484862DFF434FA5A86DE4C0B7C963958ADE35A066B9D2384076DD47
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: typeguard.Version: 4.3.0.Summary: Run-time type checker for Python.Author-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.License: MIT.Project-URL: Documentation, https://typeguard.readthedocs.io/en/latest/.Project-URL: Change log, https://typeguard.readthedocs.io/en/latest/versionhistory.html.Project-URL: Source code, https://github.com/agronholm/typeguard.Project-URL: Issue tracker, https://github.com/agronholm/typeguard/issues.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Python: >=3.8.Description-Content

C:\Users\user\AppData\Local\Temp\_MEI59722\typeguard-4.3.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2402
Entropy (8bit):	5.729208478282605
Encrypted:	false
SSDEEP:	48:eDnuX3DVED9HDDeDfPDLkAosGDlDiVoBFj7XH0H3HuwVB6Kgfkx7J/Q1NK1cQyxk:eyX3WRHDiLPjksV7I47J/Q1U6Qyx5fsJ
MD5:	D680B2881597974ACD91750E5AB61010
SHA1:	E00ED2416B5CE21641E3946905504D62D536972F
SHA-256:	48A51959582478352275428CEECD78EF77D79AC9DAE796E39A2EAF2540282552
SHA-512:	112172ACB515B0712AC58D78898EB159580ADA3DD3F16AABB37CB7A8D964F9E4BADF2869A245927B83B208D56904831C0F04ED925C95DFCB705801734FB0C7BA
Malicious:	false
Preview:	typeguard-4.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..typeguard-4.3.0.dist-info/LICENSE,sha256=YWP3mH37ONa8MgzitwsvArhivEESZRbVUu8c1DJH51g,1130..typeguard-4.3.0.dist-info/METADATA,sha256=z2dcHAp0TwhYCFU5Deh8x31nazElgujUz9tbuP0pjSE,3717..typeguard-4.3.0.dist-info/RECORD,,..typeguard-4.3.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..typeguard-4.3.0.dist-info/entry_points.txt,sha256=qp7NQ1aLtiSgMQqo6gWlfGpy0IIXzoMJmeQTLpzqFZQ,48..typeguard-4.3.0.dist-info/top_level.txt,sha256=4z28AhuDodwRS_c1J_l8H51t5QuwfTseskYzlxp6grs,10..typeguard/__init__.py,sha256=Onh4w38elPCjtlcU3JY9k3h70NjsxXIkAflmQn-Z0FY,2071..typeguard/__pycache__/__init__.cpython-312.pyc,,..typeguard/__pycache__/_checkers.cpython-312.pyc,,..typeguard/__pycache__/_config.cpython-312.pyc,,..typeguard/__pycache__/_decorators.cpython-312.pyc,,..typeguard/__pycache__/_exceptions.cpython-312.pyc,,..typeguard/__pycache__/_functions.cpython-312.pyc,,..typeguard/__pycache__/_i

C:\Users\user\AppData\Local\Temp\_MEI59722\typeguard-4.3.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI59722\typeguard-4.3.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.155187698990101
Encrypted:	false
SSDEEP:	3:mWSJCQEjMitjHfLvn:mrMJHfbn
MD5:	AEAB5BCF8BF89A51C97C4CDF70578848
SHA1:	2E9C1617560AB66431AAB90700DB901985293485
SHA-256:	AA9ECD43568BB624A0310AA8EA05A57C6A72D08217CE830999E4132E9CEA1594
SHA-512:	2BE73E99296DF26A28835F91DD8BC50EB104AF06A3C54666175FAF322E0AD4620453DB0388531C4113B052A92C1D2E4C3088E25AF43CDE42AA852CF7B0CB5B05
Malicious:	false
Preview:	[pytest11].typeguard = typeguard._pytest_plugin.

C:\Users\user\AppData\Local\Temp\_MEI59722\typeguard-4.3.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:LEJn:M
MD5:	004A2A8CE1AB120A63902A27D76BD964
SHA1:	A4E367AB40410598DADD1FC5F680ED7A176BEB09
SHA-256:	E33DBC021B83A1DC114BF73527F97C1F9D6DE50BB07D3B1EB24633971A7A82BB
SHA-512:	0D8FF9A43897AB390AB41AFE5BAC8BD38A68C2BEF88E844E5B49BF70E3164B226975CC2717AE3DC3428D1CFBB0BE068C243F104915FEE1FFA58C23FBE76FDB89
Malicious:	false
Preview:	typeguard.

C:\Users\user\AppData\Local\Temp\_MEI59722\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1138456
Entropy (8bit):	5.4617453207817395
Encrypted:	false
SSDEEP:	12288:FrEHdcM6hbaCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcQoC:FrEX/Cjfk7bPNfv42BN6yzUQoC
MD5:	098CC6AD04199442C3E2A60E1243C2DC
SHA1:	4C92C464A8E1E56E1C4D77CD30A0DA474A026AAF
SHA-256:	64A162D6B11BA10CB11509F3CC445F17BEB7ACFD064F030B4D59FAA1C9894B29
SHA-512:	73C28488B42A0BC2F0D2861FED3F5DCCCF8959CE19D3121C13C998DB496F2822DEB40F36F86240C8D3954FD2DC2BA5D63C8A125B62324DCD92FB6C8BA49FF170
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................(.....(.....(.....(.....)................).....).....)x....)....Rich..........................PE..d....g.f.........." ...).@..........0*.......................................p......U.....`.........................................p...X............P.......@.......0.../...`......P^..T............................]..@............P..p............................text....>.......@.................. ..`.rdata..\....P.......D..............@..@.data........ ......................@....pdata.......@......................@..@.rsrc........P.......$..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59722\wheel-0.43.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI59722\wheel-0.43.0.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.115074330424529
Encrypted:	false
SSDEEP:	24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
MD5:	7FFB0DB04527CFE380E4F2726BD05EBF
SHA1:	5B39C45A91A556E5F1599604F1799E4027FA0E60
SHA-256:	30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
SHA-512:	205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
Malicious:	false
Preview:	MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

C:\Users\user\AppData\Local\Temp\_MEI59722\wheel-0.43.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.088249746074878
Encrypted:	false
SSDEEP:	48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
MD5:	EBEA27DA14E3F453119DC72D84343E8C
SHA1:	7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
SHA-256:	59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
SHA-512:	A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

C:\Users\user\AppData\Local\Temp\_MEI59722\wheel-0.43.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	5.714200636114494
Encrypted:	false
SSDEEP:	96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
MD5:	44D352C4997560C7BFB82D9360F5985A
SHA1:	BE58C7B8AB32790384E4E4F20865C4A88414B67A
SHA-256:	783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
SHA-512:	281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
Malicious:	false
Preview:	../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

C:\Users\user\AppData\Local\Temp\_MEI59722\wheel-0.43.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI59722\wheel-0.43.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.271713330022269
Encrypted:	false
SSDEEP:	3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
MD5:	6180E17C30BAE5B30DB371793FCE0085
SHA1:	E3A12C421562A77D90A13D8539A3A0F4D3228359
SHA-256:	AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
SHA-512:	69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
Malicious:	false
Preview:	[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

C:\Users\user\AppData\Local\Temp\_MEI59722\win32\win32crypt.pyd

Download File

Process:	C:\Users\user\Desktop\cPl7CoJTBx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	123904
Entropy (8bit):	5.966619585818369
Encrypted:	false
SSDEEP:	3072:07jbPA0SD9S3vrCqf93qMHxCjdLZn1Ya:07jtS9SfuCRCjFV
MD5:	47C91C74BB2C5CF696626AF04F3705AB
SHA1:	C086BC2825969756169FAB7DD2E560D360E1E09C
SHA-256:	F6EAD250FC2DE4330BD26079A44DED7F55172E05A70E28AD85D09E7881725155
SHA-512:	E6B6A4425B3E30CEA7BF8B09971FA0C84D6317B1A37BC1518266DC8D72C166099A8FC40A9B985300901BD921E444FF438FD30B814C1F1C6A051DF3471615C2BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U...U...U...\.v.S.......Q.......E.......].......V.....Q...A...R...U........\.....T.....T...RichU...........PE..d......d.........." ................(........................................ ............`..........................................o..................d.......................H....G..T............................H..8............................................text...~........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata..............................@..@.rsrc...d...........................@..@.reloc..H...........................@..B........................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.997079540333128
TrID:	Win64 Executable GUI (202006/5) 77.37% InstallShield setup (43055/19) 16.49% Win64 Executable (generic) (12005/4) 4.60% Generic Win/DOS Executable (2004/3) 0.77% DOS Executable Generic (2002/1) 0.77%
File name:	cPl7CoJTBx.exe
File size:	18'991'698 bytes
MD5:	32554d2f5dcd9927b21b43dda85359c2
SHA1:	cfc29320a821c84661de03ef07f96d6e0f9a707a
SHA256:	e68f4ed80cc5d1c699653e106b4f36693dc45c0e571b9a71a1f010b1516a2271
SHA512:	0eb0f72835201ef640e39f1bfe054d92e2c229726da0672c296a3081e202f388eb4584363293733692babcf4fdcfd37e27e9c60860914774185a4ce278653978
SSDEEP:	393216:AhKRil825Im+fhZ2YsHFUK2J7XMCHWUjWodaI8kStKcvC86KOYPi9R4:AhNWm+5Z2YwUlJ7XMb8WDI0Kcq1
TLSH:	2F173355577225BAEDE7543D8EA7E346C6A2F8951BA0CB4F53F822212E730E00D38F52
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Zpc.Zpc.Zpc...`.]pc...f..pc...g.Ppc.....Ypc...`.Spc...g.Kpc...f.rpc...b.Qpc.Zpb..pc.O.g.Cpc.O.a.[pc.RichZpc.........PE..d..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14000cdb0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x670AF2C4 [Sat Oct 12 22:05:56 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FDF1D04E46Ch
dec eax
add esp, 28h
jmp 00007FDF1D04E08Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FDF1D04E838h
test eax, eax
je 00007FDF1D04E233h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FDF1D04E217h
dec eax
cmp ecx, eax
je 00007FDF1D04E226h
xor eax, eax
dec eax
cmpxchg dword ptr [0003577Ch], ecx
jne 00007FDF1D04E200h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FDF1D04E209h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FDF1D04E219h
mov byte ptr [00035765h], 00000001h
call 00007FDF1D04D965h
call 00007FDF1D04EC50h
test al, al
jne 00007FDF1D04E216h
xor al, al
jmp 00007FDF1D04E226h
call 00007FDF1D05B76Fh
test al, al
jne 00007FDF1D04E21Bh
xor ecx, ecx
call 00007FDF1D04EC60h
jmp 00007FDF1D04E1FCh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003572Ch], 00000000h
mov ebx, ecx
jne 00007FDF1D04E279h
cmp ecx, 01h
jnbe 00007FDF1D04E27Ch
call 00007FDF1D04E7AEh
test eax, eax
je 00007FDF1D04E23Ah
test ebx, ebx
jne 00007FDF1D04E236h
dec eax
lea ecx, dword ptr [00035716h]
call 00007FDF1D05B562h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca5c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x568	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2250	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f00	0x2a000	a6c3b829cc8eaabb1a474c227e90407f	False	0.5514206659226191	data	6.487493643901088	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a50	0x12c00	ab6b5f10fdacea1311f022481f2c56da	False	0.52453125	data	5.752791104854443	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2250	0x2400	181312260a85d10a1454ba38901c499b	False	0.4705946180555556	data	5.290347578351011	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x568	0x600	1f909f1505d4aac403fc692b4e3c4933	False	0.4375	data	5.515698942150982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x47058	0x50d	XML 1.0 document, ASCII text			0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 15, 2024 09:33:02.709101915 CEST	49706	443	192.168.2.5	162.159.128.233
Oct 15, 2024 09:33:02.709172010 CEST	443	49706	162.159.128.233	192.168.2.5
Oct 15, 2024 09:33:02.709240913 CEST	49706	443	192.168.2.5	162.159.128.233
Oct 15, 2024 09:33:02.710515022 CEST	49706	443	192.168.2.5	162.159.128.233
Oct 15, 2024 09:33:02.710527897 CEST	443	49706	162.159.128.233	192.168.2.5
Oct 15, 2024 09:33:03.366235971 CEST	443	49706	162.159.128.233	192.168.2.5
Oct 15, 2024 09:33:03.366926908 CEST	49706	443	192.168.2.5	162.159.128.233
Oct 15, 2024 09:33:03.366959095 CEST	443	49706	162.159.128.233	192.168.2.5
Oct 15, 2024 09:33:03.368561983 CEST	443	49706	162.159.128.233	192.168.2.5
Oct 15, 2024 09:33:03.368628025 CEST	49706	443	192.168.2.5	162.159.128.233
Oct 15, 2024 09:33:03.370228052 CEST	49706	443	192.168.2.5	162.159.128.233
Oct 15, 2024 09:33:03.370383978 CEST	49706	443	192.168.2.5	162.159.128.233
Oct 15, 2024 09:33:03.370387077 CEST	443	49706	162.159.128.233	192.168.2.5
Oct 15, 2024 09:33:03.370431900 CEST	49706	443	192.168.2.5	162.159.128.233

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 15, 2024 09:33:02.687716961 CEST	54802	53	192.168.2.5	1.1.1.1
Oct 15, 2024 09:33:02.695409060 CEST	53	54802	1.1.1.1	192.168.2.5
Oct 15, 2024 09:33:23.843111038 CEST	53	49791	162.159.36.2	192.168.2.5
Oct 15, 2024 09:33:24.316951990 CEST	63227	53	192.168.2.5	1.1.1.1
Oct 15, 2024 09:33:24.324331999 CEST	53	63227	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 15, 2024 09:33:02.687716961 CEST	192.168.2.5	1.1.1.1	0x8f1b	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)	false
Oct 15, 2024 09:33:24.316951990 CEST	192.168.2.5	1.1.1.1	0x364a	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 15, 2024 09:33:02.695409060 CEST	1.1.1.1	192.168.2.5	0x8f1b	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)	false
Oct 15, 2024 09:33:02.695409060 CEST	1.1.1.1	192.168.2.5	0x8f1b	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)	false
Oct 15, 2024 09:33:02.695409060 CEST	1.1.1.1	192.168.2.5	0x8f1b	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)	false
Oct 15, 2024 09:33:02.695409060 CEST	1.1.1.1	192.168.2.5	0x8f1b	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)	false
Oct 15, 2024 09:33:02.695409060 CEST	1.1.1.1	192.168.2.5	0x8f1b	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)	false
Oct 15, 2024 09:33:24.324331999 CEST	1.1.1.1	192.168.2.5	0x364a	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	03:32:52
Start date:	15/10/2024
Path:	C:\Users\user\Desktop\cPl7CoJTBx.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\cPl7CoJTBx.exe"
Imagebase:	0x7ff7b3c50000
File size:	18'991'698 bytes
MD5 hash:	32554D2F5DCD9927B21B43DDA85359C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:32:55
Start date:	15/10/2024
Path:	C:\Users\user\Desktop\cPl7CoJTBx.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\cPl7CoJTBx.exe"
Imagebase:	0x7ff7b3c50000
File size:	18'991'698 bytes
MD5 hash:	32554D2F5DCD9927B21B43DDA85359C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LunaGrabber, Description: Yara detected Luna Grabber, Source: 00000002.00000002.2192800204.0000024E26D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2192800204.0000024E26D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LunaLogger, Description: Yara detected Luna Logger, Source: 00000002.00000002.2192800204.0000024E26D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:32:59
Start date:	15/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Imagebase:	0x7ff7bb0e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:32:59
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:33:00
Start date:	15/10/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff664270000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 00007FF7B3C589E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B3C59390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7B3C545F4,00000000,00007FF7B3C51985), ref: 00007FF7B3C593C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58A56

Part of subcall function 00007FF7B3C6A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C6A490

Part of subcall function 00007FF7B3C6871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C68783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58AE6
CreateProcessW.KERNELBASE ref: 00007FF7B3C58B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58B28

Part of subcall function 00007FF7B3C52C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B3C53706,?,00007FF7B3C53804), ref: 00007FF7B3C52C9E
Part of subcall function 00007FF7B3C52C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B3C53706,?,00007FF7B3C53804), ref: 00007FF7B3C52D63
Part of subcall function 00007FF7B3C52C50: MessageBoxW.USER32 ref: 00007FF7B3C52D99

RegisterClassW.USER32 ref: 00007FF7B3C58B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58B8B
CreateWindowExW.USER32 ref: 00007FF7B3C58BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58C15
PeekMessageW.USER32 ref: 00007FF7B3C58C39
TranslateMessage.USER32 ref: 00007FF7B3C58C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58C51
PeekMessageW.USER32 ref: 00007FF7B3C58C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58E04
GetExitCodeProcess.KERNELBASE ref: 00007FF7B3C58E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58E2F

Strings

PyInstaller Onefile Hidden Window, xrefs: 00007FF7B3C58B95
Failed to create child process!, xrefs: 00007FF7B3C58B30
PyInstallerOnefileHiddenWindow, xrefs: 00007FF7B3C58B54
CreateProcessW, xrefs: 00007FF7B3C58B37

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: c6fec44b3e06f5cb5d476b6d45460a211f2265847313120db2772df73325fd04
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 07D17531A08B8286E790AFB8D8592B9B760FF65759F800135DF5D636D8DF3CE1848710

Function 00007FF7B3C51000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7B3C53BE8
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF7B3C53A0B, 00007FF7B3C53CD4, 00007FF7B3C53F63
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7B3C53D12
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF7B3C53882, 00007FF7B3C538AF
_PYI_SPLASH_IPC, xrefs: 00007FF7B3C53A23, 00007FF7B3C53EED
MEI, xrefs: 00007FF7B3C53933
pyi-python-flag, xrefs: 00007FF7B3C53AD6
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7B3C53C61
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7B3C53E9E
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF7B3C53A17, 00007FF7B3C53A2F, 00007FF7B3C53A9B
Failed to remove temporary directory: %s, xrefs: 00007FF7B3C53FC7
pyi-runtime-tmpdir, xrefs: 00007FF7B3C53B68
Failed to convert DLL search path!, xrefs: 00007FF7B3C53DD4
Py_GIL_DISABLED, xrefs: 00007FF7B3C53AF4
_PYI_ARCHIVE_FILE, xrefs: 00007FF7B3C538D2, 00007FF7B3C539FF
pyi-disable-windowed-traceback, xrefs: 00007FF7B3C53BB2
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF7B3C53D35
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF7B3C53E02
pyi-contents-directory, xrefs: 00007FF7B3C53B8D
Failed to start splash screen!, xrefs: 00007FF7B3C53ECC
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF7B3C53B32
Could not create temporary directory!, xrefs: 00007FF7B3C53CBF
pkg, xrefs: 00007FF7B3C539BE
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7B3C53971
VCRUNTIME140.dll, xrefs: 00007FF7B3C53DA9
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7B3C539DE
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7B3C53EB3
Failed to load splash screen resources!, xrefs: 00007FF7B3C53E7D

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 91c44f4ff4367e6b74f0cb80bb41d1c37803098fd5af71a521999ebb342f3785
Instruction ID: a9584ce3fd673464dbe752328a2047b97512c3e62203ef1ceb7da93a107916a4
Opcode Fuzzy Hash: 91c44f4ff4367e6b74f0cb80bb41d1c37803098fd5af71a521999ebb342f3785
Instruction Fuzzy Hash: 20327021B0C68291EB95B7A8945E3B9A651AF66780FC54033DB4D632DEDF2CF5D4C320

Function 00007FF7B3C75C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7B3C75C45

Part of subcall function 00007FF7B3C75598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C755AC

Part of subcall function 00007FF7B3C6A948: RtlFreeHeap.NTDLL(?,?,?,00007FF7B3C72D22,?,?,?,00007FF7B3C72D5F,?,?,00000000,00007FF7B3C73225,?,?,?,00007FF7B3C73157), ref: 00007FF7B3C6A95E
Part of subcall function 00007FF7B3C6A948: GetLastError.KERNEL32(?,?,?,00007FF7B3C72D22,?,?,?,00007FF7B3C72D5F,?,?,00000000,00007FF7B3C73225,?,?,?,00007FF7B3C73157), ref: 00007FF7B3C6A968

Part of subcall function 00007FF7B3C6A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7B3C6A8DF,?,?,?,?,?,00007FF7B3C6A7CA), ref: 00007FF7B3C6A909
Part of subcall function 00007FF7B3C6A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7B3C6A8DF,?,?,?,?,?,00007FF7B3C6A7CA), ref: 00007FF7B3C6A92E

_get_daylight.LIBCMT ref: 00007FF7B3C75C34

Part of subcall function 00007FF7B3C755F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C7560C

_get_daylight.LIBCMT ref: 00007FF7B3C75EAA
_get_daylight.LIBCMT ref: 00007FF7B3C75EBB
_get_daylight.LIBCMT ref: 00007FF7B3C75ECC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7B3C7610C), ref: 00007FF7B3C75EF3

Strings

Eastern Summer Time, xrefs: 00007FF7B3C75FB1
Eastern Standard Time, xrefs: 00007FF7B3C75F99

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction ID: a0b87f4e277a0dc3ba0e17cf905754e48446f75c78ff0443d4b81e1ab99e36ba
Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction Fuzzy Hash: 16D10526A0824285E7A0BFA9C4491B9A751FFA6785FC48135DF1D676CDDF3CE8C18360

Function 00007FF7B3C76964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B3C76698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C766D9
Part of subcall function 00007FF7B3C76698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C76757
Part of subcall function 00007FF7B3C76698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C767A8

CreateFileW.KERNELBASE ref: 00007FF7B3C76A6A
CreateFileW.KERNEL32 ref: 00007FF7B3C76ABA
GetLastError.KERNEL32 ref: 00007FF7B3C76AEA
GetFileType.KERNELBASE ref: 00007FF7B3C76AFF
GetLastError.KERNEL32 ref: 00007FF7B3C76B09
CloseHandle.KERNEL32 ref: 00007FF7B3C76B3C
CloseHandle.KERNEL32 ref: 00007FF7B3C76C9F
CreateFileW.KERNEL32 ref: 00007FF7B3C76CD4
GetLastError.KERNEL32 ref: 00007FF7B3C76CE3

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: c9cf33d0bbf0bdbfd8c0dccb2242c80b88215a9462bc57630f9ddd37fcb7395d
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 03C1D232B28A41D5EB50EFA9C4942AC7761F75AB98B410235DF1EA77D8DF38D0A1C310

Function 00007FF7B3C583C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF7B3C58919,00007FF7B3C53F9D), ref: 00007FF7B3C5842B
RemoveDirectoryW.KERNEL32(?,00007FF7B3C58919,00007FF7B3C53F9D), ref: 00007FF7B3C584AE
DeleteFileW.KERNELBASE(?,00007FF7B3C58919,00007FF7B3C53F9D), ref: 00007FF7B3C584CD
FindNextFileW.KERNELBASE(?,00007FF7B3C58919,00007FF7B3C53F9D), ref: 00007FF7B3C584DB
FindClose.KERNEL32(?,00007FF7B3C58919,00007FF7B3C53F9D), ref: 00007FF7B3C584EC
RemoveDirectoryW.KERNELBASE(?,00007FF7B3C58919,00007FF7B3C53F9D), ref: 00007FF7B3C584F5

Strings

%s\*, xrefs: 00007FF7B3C583F2

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 7c12b01ff297979e1ecdf005a6213684df6049b407edb1b83f88227167b7eee2
Instruction ID: 4f0a9286a96693abb54686e0430dab70ec85aa819ea45a6b9c380770ce0c97fc
Opcode Fuzzy Hash: 7c12b01ff297979e1ecdf005a6213684df6049b407edb1b83f88227167b7eee2
Instruction Fuzzy Hash: 2C418621B0D642C1EAA0BB98E45D1BAA360FB66755FC10232DB5E636DCDF3CE585C710

Function 00007FF7B3C75E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7B3C75EAA

Part of subcall function 00007FF7B3C755F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C7560C

_get_daylight.LIBCMT ref: 00007FF7B3C75EBB

Part of subcall function 00007FF7B3C75598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C755AC

_get_daylight.LIBCMT ref: 00007FF7B3C75ECC

Part of subcall function 00007FF7B3C755C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C755DC

Part of subcall function 00007FF7B3C6A948: RtlFreeHeap.NTDLL(?,?,?,00007FF7B3C72D22,?,?,?,00007FF7B3C72D5F,?,?,00000000,00007FF7B3C73225,?,?,?,00007FF7B3C73157), ref: 00007FF7B3C6A95E
Part of subcall function 00007FF7B3C6A948: GetLastError.KERNEL32(?,?,?,00007FF7B3C72D22,?,?,?,00007FF7B3C72D5F,?,?,00000000,00007FF7B3C73225,?,?,?,00007FF7B3C73157), ref: 00007FF7B3C6A968

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7B3C7610C), ref: 00007FF7B3C75EF3

Strings

Eastern Summer Time, xrefs: 00007FF7B3C75FB1
Eastern Standard Time, xrefs: 00007FF7B3C75F99

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction ID: 185976b2be32510bde824ed1534ab51c5e70c68571550b6affde701e9b5be298
Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction Fuzzy Hash: 2051D731A0864286E790FFA9D889179E750FBAA784FC04135DF1D676D9DF3CE4818760

Function 00007FF7B3C59280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7B3C592B3
FindClose.KERNELBASE ref: 00007FF7B3C592C2

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: f100b107018daa9a7eb4c0186988f4c2714df4559e6a539b1930a9fc636755a8
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 26F0A922A1864186F7E09BE8B48D776B350AB55328F850236DB6D11AD8DF3CD088C600

Function 00007FF7B3C708C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 49a962b3c018803b14b604544b9264321a1d27846e4e6d28d18704345653ae43
Instruction ID: 4aba8a35f2c5eb284e5339fa177d6ccc24b836ed0a85112e624eaa34f7f9c97f
Opcode Fuzzy Hash: 49a962b3c018803b14b604544b9264321a1d27846e4e6d28d18704345653ae43
Instruction Fuzzy Hash: EF020521A1D66680FAD5BB9D940C239E684AF63BA1FD54234DF5D673C9DE3CE4C18320

Function 00007FF7B3C51950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B3C57F90: _fread_nolock.LIBCMT ref: 00007FF7B3C5803A

_fread_nolock.LIBCMT ref: 00007FF7B3C51A1B

Part of subcall function 00007FF7B3C52910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7B3C51B6A), ref: 00007FF7B3C5295E

Strings

Could not allocate memory for archive structure!, xrefs: 00007FF7B3C51A61
MEI, xrefs: 00007FF7B3C51991
fseek, xrefs: 00007FF7B3C519F5
Could not allocate buffer for TOC!, xrefs: 00007FF7B3C51B1B
Could not read full TOC!, xrefs: 00007FF7B3C51B55
Failed to seek to cookie position!, xrefs: 00007FF7B3C519EE
Error on file., xrefs: 00007FF7B3C51B8D
malloc, xrefs: 00007FF7B3C51B22
calloc, xrefs: 00007FF7B3C51A68
fread, xrefs: 00007FF7B3C51A32, 00007FF7B3C51B5C
Failed to read cookie!, xrefs: 00007FF7B3C51A2B

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 507f08f26e205d920f148b85cad333997b9676a31346628d4d7d58e95cedc463
Instruction ID: 3034098935f58f582c62af934678e8003971c9b4d8b9abb8e3aab44a60b9834f
Opcode Fuzzy Hash: 507f08f26e205d920f148b85cad333997b9676a31346628d4d7d58e95cedc463
Instruction Fuzzy Hash: 7A81B371A0C68285EB90FBA8D05E2B9B390AF66744F815432DB4D637CDDE3CE5C58720

Function 00007FF7B3C51600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7B3C517DF
Failed to extract %s: failed to open target file!, xrefs: 00007FF7B3C5165C
fseek, xrefs: 00007FF7B3C516E1
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7B3C516A2
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7B3C516DA
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7B3C51742
fopen, xrefs: 00007FF7B3C51663
malloc, xrefs: 00007FF7B3C51749
fwrite, xrefs: 00007FF7B3C517D1
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7B3C517CA
fread, xrefs: 00007FF7B3C517E6
Failed to create symbolic link %s!, xrefs: 00007FF7B3C51622

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 1024a7a5ee8cd7a3c756baff70d017aadc137d22fcd9cea75d224d6f76c21f88
Instruction ID: e65bec370956f9dc6a20cfc58d186693dd383df30c622eccd5a3ee24532a3616
Opcode Fuzzy Hash: 1024a7a5ee8cd7a3c756baff70d017aadc137d22fcd9cea75d224d6f76c21f88
Instruction Fuzzy Hash: 9A51B221B0864382EA90BB9994191B9E3A0BF62794FC54532EF1C677DEDF3CE5C58320

Function 00007FF7B3C58660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF7B3C53CBB), ref: 00007FF7B3C58704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF7B3C53CBB), ref: 00007FF7B3C5870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF7B3C53CBB), ref: 00007FF7B3C5874C

Part of subcall function 00007FF7B3C58830: GetEnvironmentVariableW.KERNEL32(00007FF7B3C5388E), ref: 00007FF7B3C58867
Part of subcall function 00007FF7B3C58830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7B3C58889

Part of subcall function 00007FF7B3C68238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C68251

Part of subcall function 00007FF7B3C52810: MessageBoxW.USER32 ref: 00007FF7B3C528EA

Strings

TMP, xrefs: 00007FF7B3C586C2
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7B3C586DC
_MEI%d, xrefs: 00007FF7B3C58712
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7B3C5877E
TMP, xrefs: 00007FF7B3C5869C, 00007FF7B3C587A3

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction ID: e0825204c6435b6209dd91c64bc6d2376bd70c62261624333ef93f4a48041bf6
Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction Fuzzy Hash: E441A411B1964280EA90BBED985E2B99391AF677C0FC14032EF0D677DEDE3CE5858360

Function 00007FF7B3C51210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7B3C512EF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7B3C51276
malloc, xrefs: 00007FF7B3C512C1, 00007FF7B3C512F6
1.3.1, xrefs: 00007FF7B3C51249
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7B3C512BA
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7B3C5141E

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: b715c76ab38b7b4dfee5c32bc52a61b3ea5d4668c2ab7e2166fd60b1101cc4ae
Instruction ID: 5a7ca3ee6e16ea3ab0b66206c01aa2f2439dd58a2c4e732cb400b366517daa32
Opcode Fuzzy Hash: b715c76ab38b7b4dfee5c32bc52a61b3ea5d4668c2ab7e2166fd60b1101cc4ae
Instruction Fuzzy Hash: 1D51FA22A0864281EAA0BB99D4193B9A290FF66795FC55132EF4D677CDDF3CE481C710

Function 00007FF7B3C6ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7B3C6F0AA,?,?,-00000018,00007FF7B3C6AD53,?,?,?,00007FF7B3C6AC4A,?,?,?,00007FF7B3C65F3E), ref: 00007FF7B3C6EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF7B3C6F0AA,?,?,-00000018,00007FF7B3C6AD53,?,?,?,00007FF7B3C6AC4A,?,?,?,00007FF7B3C65F3E), ref: 00007FF7B3C6EE98

Strings

api-ms-, xrefs: 00007FF7B3C6EDD6
ext-ms-, xrefs: 00007FF7B3C6EDE9

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 9d378fc789808820c98afc50fc3eced53b48891d93ae337d3fff8002a9ae29f8
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 0341182171961141EB95ABAE9908179A291BF67B90FC44536DE1DA73CCEF3CE4858210

Function 00007FF7B3C536B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7B3C53804), ref: 00007FF7B3C536E1
GetLastError.KERNEL32(?,00007FF7B3C53804), ref: 00007FF7B3C536EB

Part of subcall function 00007FF7B3C52C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B3C53706,?,00007FF7B3C53804), ref: 00007FF7B3C52C9E
Part of subcall function 00007FF7B3C52C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B3C53706,?,00007FF7B3C53804), ref: 00007FF7B3C52D63
Part of subcall function 00007FF7B3C52C50: MessageBoxW.USER32 ref: 00007FF7B3C52D99

Strings

Failed to obtain executable path., xrefs: 00007FF7B3C536F3
Failed to convert executable path to UTF-8., xrefs: 00007FF7B3C53790
GetModuleFileNameW, xrefs: 00007FF7B3C536FA
\\?\, xrefs: 00007FF7B3C5375A
Failed to resolve full path to executable %ls., xrefs: 00007FF7B3C53739

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: a46074bc1f8a5986d813807c8e67a93687f5f06b9e5cffd3054986fca8f5dd16
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 46219951F1854281FAA0B7A8D84E3B59250BF66385FC14133DB5DA65DEEF2CE584C710

Function 00007FF7B3C6BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C6BE89

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction ID: 339149b1a1b9e7bc21966c053e50a93e97ae6039aa8d36866a3be5dfc145d902
Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction Fuzzy Hash: D0C1072290C68691E6A06FDA94482BDBB54FBA2B80FD50131DB4DA77DDCE7CE4C58720

Function 00007FF7B3C58570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7B3C58590
OpenProcessToken.ADVAPI32 ref: 00007FF7B3C585A3
GetTokenInformation.KERNELBASE ref: 00007FF7B3C585C8
GetLastError.KERNEL32 ref: 00007FF7B3C585D2
GetTokenInformation.KERNELBASE ref: 00007FF7B3C58612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7B3C5862E
CloseHandle.KERNEL32 ref: 00007FF7B3C58646

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction ID: a1b571f4041bd252ef74bdd12c4116b6b8674f7c74c71e1f6470bc4ecf962fbd
Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction Fuzzy Hash: BB217821B0C74682EB906B9DB54913AE3A0FF927A0F900235EB6D536DCDE7CE4858710

Function 00007FF7B3C590E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B3C58570: GetCurrentProcess.KERNEL32 ref: 00007FF7B3C58590
Part of subcall function 00007FF7B3C58570: OpenProcessToken.ADVAPI32 ref: 00007FF7B3C585A3
Part of subcall function 00007FF7B3C58570: GetTokenInformation.KERNELBASE ref: 00007FF7B3C585C8
Part of subcall function 00007FF7B3C58570: GetLastError.KERNEL32 ref: 00007FF7B3C585D2
Part of subcall function 00007FF7B3C58570: GetTokenInformation.KERNELBASE ref: 00007FF7B3C58612
Part of subcall function 00007FF7B3C58570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7B3C5862E
Part of subcall function 00007FF7B3C58570: CloseHandle.KERNEL32 ref: 00007FF7B3C58646

LocalFree.KERNEL32(?,00007FF7B3C53C55), ref: 00007FF7B3C5916C
LocalFree.KERNEL32(?,00007FF7B3C53C55), ref: 00007FF7B3C59175

Strings

D:(A;;FA;;;%s), xrefs: 00007FF7B3C59157
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7B3C59183
S-1-3-4, xrefs: 00007FF7B3C59121
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7B3C59142

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction ID: 89c47cd2a938f15830779e69dd49d13590687abd7bb9d1fae088e5f1a45b95d5
Opcode Fuzzy Hash: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction Fuzzy Hash: E6214121A0874181F690BB98E41E2FAA250FFA6780FC54036EB4D637DADF3DD585C760

Function 00007FF7B3C57E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF7B3C5352C,?,00000000,00007FF7B3C53F1B), ref: 00007FF7B3C57F32

Strings

\, xrefs: 00007FF7B3C57E97
%s%c, xrefs: 00007FF7B3C57EA4
%.*s, xrefs: 00007FF7B3C57EEB

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction ID: ac114a7a6db2290fa00442cfb4c149d37fd76c129da2900370d61450910a89a2
Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction Fuzzy Hash: F8310921619AC145EAA1EB58E8193BAA254EB95BE0F900232EF6D537CDDF2CD2858710

Function 00007FF7B3C6CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B3C6CF4B), ref: 00007FF7B3C6D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B3C6CF4B), ref: 00007FF7B3C6D107

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 56dfebb5ca6322fb04c47076f0f714e5a3dcc9659065a7a72cffe884ec5e9ff1
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: E691F622E1865185F790AFAD844827DA7A0BB66B98F944135DF0EB36C9CF39D4C6D320

Function 00007FF7B3C6F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7B3C6FA7C
_get_daylight.LIBCMT ref: 00007FF7B3C6FA8D
_get_daylight.LIBCMT ref: 00007FF7B3C6FA9E
_isindst.LIBCMT ref: 00007FF7B3C6FB69

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 8a3a5e73cbe1d7f749e815bc29cf23bfed4356affbae38564508d71a3fc01c52
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 25514A72F0421186FB54EFAC98592BCA761AF61358F901239DF1DA3ADDDF38A482C710

Function 00007FF7B3C6577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF7B3C657AF
GetFileInformationByHandle.KERNELBASE ref: 00007FF7B3C65811
GetLastError.KERNEL32 ref: 00007FF7B3C658A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B3C656B4), ref: 00007FF7B3C658EE

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
Instruction ID: d31fd36751b53e10f7519683686ae40593c186350f506316241d97ff8782fe8e
Opcode Fuzzy Hash: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
Instruction Fuzzy Hash: 7851A222E0864189F790EFB9D4543BDB7A1AB59B58F605434DF0DA76C8DF38D8818720

Function 00007FF7B3C65628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C65655
CreateFileW.KERNELBASE ref: 00007FF7B3C65694
CloseHandle.KERNEL32 ref: 00007FF7B3C656C9

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction ID: 605721e4370a51394ba8c74b10d39ef6eb861dedbc28f6000292dbef848f3043
Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction Fuzzy Hash: A141B432D1878183E790ABA49518369B360FBA6364F609334EB9C53AD9DF7CE4E08710

Function 00007FF7B3C5CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B3C5CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7B3C5CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7B3C5CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF7B3C5CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7B3C5CD21

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: eb6a110a8f99e54fd3fd77bac3f367e303f863454e7ce981f5336428f1ddceaf
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: B7313D21E0824641FAD4BBED941E3B9A2919F63744FC69036DB4DA72DFDE2DA4848321

Function 00007FF7B3C69A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7B3C69A2C), ref: 00007FF7B3C69A41
TerminateProcess.KERNEL32(?,?,?,00007FF7B3C69A2C), ref: 00007FF7B3C69A4C
ExitProcess.KERNEL32 ref: 00007FF7B3C69A5B

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction ID: d0f79cd4eb81018869e1c588669180e637522375cd7d2a54ad681286781f8bb3
Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction Fuzzy Hash: 03D09E10B0870683EB943BF95D5D0B892956F6A712F941438CE0B673DBDD2DA8CA4320

Function 00007FF7B3C6013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C60180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C60277

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 01370cde678f49017d71bb41bd3cba8acc18867687378564ac17eb8ee7a617f0
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 64511F21B0D25186E7E4B9AD9408679E290BF96BA4F844634DF6DB37CDCE3CE4818620

Function 00007FF7B3C6C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7B3C6C2CD), ref: 00007FF7B3C6C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF7B3C6C2CD), ref: 00007FF7B3C6C18A

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 6781698d2b3ac69246787e2fb3855e6aef61dcf86623f06367dbc812ea8af9d7
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 2C110462608A8181DAA0AB69A808069E361BB52FF0F944331EF7D5B7DDCE3CD0908710

Function 00007FF7B3C65924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B3C65839), ref: 00007FF7B3C65957
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B3C65839), ref: 00007FF7B3C6596D

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction ID: d39bca82809227753433baf595cdf01585045cd7b2049d639c1ddbdab5164fa6
Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction Fuzzy Hash: 2711943160C60281EB946B98A41507BF760FB96771FA00236FB9D92ADCEF6CD495DB20

Function 00007FF7B3C6A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7B3C72D22,?,?,?,00007FF7B3C72D5F,?,?,00000000,00007FF7B3C73225,?,?,?,00007FF7B3C73157), ref: 00007FF7B3C6A95E
GetLastError.KERNEL32(?,?,?,00007FF7B3C72D22,?,?,?,00007FF7B3C72D5F,?,?,00000000,00007FF7B3C73225,?,?,?,00007FF7B3C73157), ref: 00007FF7B3C6A968

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: e1fb127a185e9cfa9c15e0ec131cd6cc15899ae09bd8977e5c0385ca2af3f222
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: 55E08650F4960282FF897BF9685D178D2516FA6B01FC50030CF0DA72D9EE2CA8C18330

Function 00007FF7B3C6AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7B3C6A9D5,?,?,00000000,00007FF7B3C6AA8A), ref: 00007FF7B3C6ABC6
GetLastError.KERNEL32(?,?,?,00007FF7B3C6A9D5,?,?,00000000,00007FF7B3C6AA8A), ref: 00007FF7B3C6ABD0

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: fe07d9802532cfbe84222394dbd4e72331475d0ef40eccb322befa031355e7b2
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: D421F665B1868241FAD077DD944C37DA2829FE6790F880239EB6EA77CDCE6CE4C04324

Function 00007FF7B3C6BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C6BED4

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cbeb3b5568c01fe22c816fd393b22aefbfa64644ae8ce1fe3b0dc090283c3b2e
Instruction ID: 055fb7be67481d329dbef33404f301a441ee933c1fe590887e033a0cd7753d55
Opcode Fuzzy Hash: cbeb3b5568c01fe22c816fd393b22aefbfa64644ae8ce1fe3b0dc090283c3b2e
Instruction Fuzzy Hash: 7341DB3690824187EAB4ABDEA95817DF3A4EB67740F501131D78ED36D9CF2CE482CB61

Function 00007FF7B3C57F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7B3C5803A

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 12c7421bf9d851de3930d973ff4776f23e58c204998b3b00b1158df84cf7151e
Instruction ID: 91436b8bfb1fbf2007c76b712cc2982a6bd49a9f103c15c29dd35885c8e4edec
Opcode Fuzzy Hash: 12c7421bf9d851de3930d973ff4776f23e58c204998b3b00b1158df84cf7151e
Instruction Fuzzy Hash: 2D219322B1875146EA90BAA668093BAD641BF96BC4FC94431EF0C677CADE7DF081C214

Function 00007FF7B3C6B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C6B9C2

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: 345964ea2db7c2d1006883b1a2b81bce0665b92a48e57a0c4cc9048859a6f84f
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: 4F31A622A1860185E7917FDE884837CBA60AF62B55FC10135DB5DA33DADE7CA4C18731

Function 00007FF7B3C69961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7B3C6998F

Part of subcall function 00007FF7B3C69A88: GetModuleHandleExW.KERNEL32 ref: 00007FF7B3C69AAD
Part of subcall function 00007FF7B3C69A88: GetProcAddress.KERNEL32 ref: 00007FF7B3C69AC3
Part of subcall function 00007FF7B3C69A88: FreeLibrary.KERNEL32 ref: 00007FF7B3C69AEA

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction ID: 18d696cbc71346108f26161e9b7fe7f90686043918af899e7fe65ea1c6d06843
Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction Fuzzy Hash: FB21D172A04B4589EBA0AFA8C4882EC33E0FB55318F840636D75CA7AD9DF38D484C750

Function 00007FF7B3C65F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C65EF9

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: d8b6e95b004fb0f5113f5544b9ffe88cd92f4efcb7c632f550191c8d9988ac72
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 58118731A1C64242EAE0BF99941417DE664BFA6B84FD44431EB4CE7ADDCF3DD8814721

Function 00007FF7B3C76354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C76377

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: cafa9eeb03756c451531e00522bca4d58f673354426603ab5a92bcd5a734cf9a
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: F8212532608A41C6DBA0AF5CD444379B2A0FB95B51F940234EB5D876DDDF3CD450CB10

Function 00007FF7B3C603BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C60410

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: c658ecebf09fd5b3b3c22eb1a7052dc3a1965412b4867707928a2113450e837f
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 2701E92160875141E594EF9A5904079E690BFA7FE0F884530DF5CB37DECE3CD4818310

Function 00007FF7B3C67EFC Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C67F3A

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction ID: 74e2924192ec4034bef1dcc722d1a368c280492fb6239d9a25b97dba7f4ce2cf
Opcode Fuzzy Hash: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction Fuzzy Hash: CB01A124E1D64340FAD07BED6908579D198AF22790FE44A34EB6CE36CEDF2CA4C14232

Function 00007FF7B3C77C74 Relevance: 1.5, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B3C6D5FC: HeapAlloc.KERNEL32(?,?,?,00007FF7B3C60C90,?,?,?,00007FF7B3C622FA,?,?,?,?,?,00007FF7B3C63AE9), ref: 00007FF7B3C6D63A

RtlReAllocateHeap.NTDLL(?,?,00000000,00007FF7B3C7343B,?,?,?,00007FF7B3C69F57,?,?,?,00007FF7B3C69E4D,?,?,?,00007FF7B3C6A22E), ref: 00007FF7B3C77CE1

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Heap$AllocAllocate
String ID:
API String ID: 2177240990-0
Opcode ID: dcbe32cb79725fef9c80adacee216e442cbd3db3270989830464aff422721403
Instruction ID: 87b9c901032be609cdb081979a9893ba8de2489f017a4d98b80e5a3b5bbd7505
Opcode Fuzzy Hash: dcbe32cb79725fef9c80adacee216e442cbd3db3270989830464aff422721403
Instruction Fuzzy Hash: 36012154B0864680FDD477E96509179A1405FAA7A2FA58230EF2EA62DEDE2CE4C04631

Function 00007FF7B3C68238 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C68251

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction ID: f8f4b1a9f2e913ba93c188df7b21ab029811232ae50bae419cc9ab2cabe5ad3c
Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction Fuzzy Hash: 39E08660E9C70247F6D13AEC498917891105FB7740FC00530DB09A72CFDD2C78C55232

Function 00007FF7B3C6EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7B3C6B32A,?,?,?,00007FF7B3C64F11,?,?,?,?,00007FF7B3C6A48A), ref: 00007FF7B3C6EBED

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction ID: 92eee77bd26a0f97c0d6c5124fdc07abb8a147d0d60e57d9bf9f97c14064d97c
Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction Fuzzy Hash: 3EF04F54B0A20280FED976FD5A5D2B492845FEAB80FC84535CF0FE72CAEE1CA4C14234

Function 00007FF7B3C6D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7B3C60C90,?,?,?,00007FF7B3C622FA,?,?,?,?,?,00007FF7B3C63AE9), ref: 00007FF7B3C6D63A

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: afd5f52f29c27f8e6bfd994a950c69a764f9d23d27579b19b10e960045c3e997
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: F7F05420F0820240FED537F9580D27491504FA67A1F884B30DF2EE72CADD1CE4C49130

Non-executed Functions

Function 00007FF7B3C55830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C55840
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C55852
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C55889
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C5589B
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C558B4
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C558C6
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C558DF
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C558F1
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C5590D
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C5591F
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C5593B
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C5594D
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C55969
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C5597B
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C55997
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C559A9
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C559C5
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C559D7

Strings

PyUnicode_AsUTF8, xrefs: 00007FF7B3C55EC3, 00007FF7B3C55EE5
PyModule_GetDict, xrefs: 00007FF7B3C55CC9, 00007FF7B3C55CEB
PyUnicode_Join, xrefs: 00007FF7B3C55FA9, 00007FF7B3C55FCB
Py_DecRef, xrefs: 00007FF7B3C55836, 00007FF7B3C55858
PyConfig_SetWideStringList, xrefs: 00007FF7B3C55A73, 00007FF7B3C55A95
PyConfig_SetBytesString, xrefs: 00007FF7B3C55A17, 00007FF7B3C55A39
PyErr_Clear, xrefs: 00007FF7B3C55AA1, 00007FF7B3C55AC3
PyUnicode_FromString, xrefs: 00007FF7B3C55F7B, 00007FF7B3C55F9D
PySys_GetObject, xrefs: 00007FF7B3C55E67, 00007FF7B3C55E89
Py_IsInitialized, xrefs: 00007FF7B3C55931, 00007FF7B3C55953
PyUnicode_DecodeFSDefault, xrefs: 00007FF7B3C55F1F, 00007FF7B3C55F41
PyErr_Occurred, xrefs: 00007FF7B3C55B2B, 00007FF7B3C55B4D
PyObject_CallFunction, xrefs: 00007FF7B3C55CF7, 00007FF7B3C55D19
PyErr_Restore, xrefs: 00007FF7B3C55B87, 00007FF7B3C55BA9
Py_ExitStatusException, xrefs: 00007FF7B3C558AA, 00007FF7B3C558CC
Py_InitializeFromConfig, xrefs: 00007FF7B3C55903, 00007FF7B3C55925
PyImport_AddModule, xrefs: 00007FF7B3C55BE3, 00007FF7B3C55C05
PyMarshal_ReadObjectFromString, xrefs: 00007FF7B3C55C6D, 00007FF7B3C55C8F
Py_DecodeLocale, xrefs: 00007FF7B3C5587F, 00007FF7B3C558A1
PyRun_SimpleStringFlags, xrefs: 00007FF7B3C55E0B, 00007FF7B3C55E2D
PyErr_Print, xrefs: 00007FF7B3C55B59, 00007FF7B3C55B7B
PyEval_EvalCode, xrefs: 00007FF7B3C55BB5, 00007FF7B3C55BD7
PyConfig_Clear, xrefs: 00007FF7B3C5598D, 00007FF7B3C559AF
PyErr_Fetch, xrefs: 00007FF7B3C55ACF, 00007FF7B3C55AF1
PyStatus_Exception, xrefs: 00007FF7B3C55E39, 00007FF7B3C55E5B
Py_PreInitialize, xrefs: 00007FF7B3C5595F, 00007FF7B3C55981
PyUnicode_FromFormat, xrefs: 00007FF7B3C55F4D, 00007FF7B3C55F6F
PyConfig_Read, xrefs: 00007FF7B3C559E9, 00007FF7B3C55A0B
PyUnicode_Replace, xrefs: 00007FF7B3C55FD7, 00007FF7B3C55FF9
PyMem_RawFree, xrefs: 00007FF7B3C55C9B, 00007FF7B3C55CBD
GetProcAddress, xrefs: 00007FF7B3C55868
PyConfig_InitIsolatedConfig, xrefs: 00007FF7B3C559BB, 00007FF7B3C559DD
PyObject_Str, xrefs: 00007FF7B3C55DAF, 00007FF7B3C55DD1
PyErr_NormalizeException, xrefs: 00007FF7B3C55AFD, 00007FF7B3C55B1F
Py_Finalize, xrefs: 00007FF7B3C558D5, 00007FF7B3C558F7
PyUnicode_Decode, xrefs: 00007FF7B3C55EF1, 00007FF7B3C55F13
PyImport_ImportModule, xrefs: 00007FF7B3C55C3F, 00007FF7B3C55C61
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7B3C55DDD, 00007FF7B3C55DFF
PyObject_CallFunctionObjArgs, xrefs: 00007FF7B3C55D25, 00007FF7B3C55D47
PyConfig_SetString, xrefs: 00007FF7B3C55A45, 00007FF7B3C55A67
PyObject_SetAttrString, xrefs: 00007FF7B3C55D81, 00007FF7B3C55DA3
PySys_SetObject, xrefs: 00007FF7B3C55E95, 00007FF7B3C55EB7
PyObject_GetAttrString, xrefs: 00007FF7B3C55D53, 00007FF7B3C55D75
PyImport_ExecCodeModule, xrefs: 00007FF7B3C55C11, 00007FF7B3C55C33
Failed to get address for %hs, xrefs: 00007FF7B3C55861

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 21f5facf22384e5425ab7cb47c3415d5fc7c56c11a7207b93fd420eb32fc09e3
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: 2222DC6194DB07D1FAC5BBDDA81D178A2A0BF26756FC55036CA1E212DDFF3CA5C88220

Function 00007FF7B3C740AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7B3C740FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C74766
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C748DC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C74B9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C74DBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C74FF7
memcpy_s.LIBCPMT ref: 00007FF7B3C750D2
memcpy_s.LIBCPMT ref: 00007FF7B3C7517D
memcpy_s.LIBCPMT ref: 00007FF7B3C7524C

Strings

1#IND, xrefs: 00007FF7B3C741E7
1#INF, xrefs: 00007FF7B3C74223
1#QNAN, xrefs: 00007FF7B3C74213
1#SNAN, xrefs: 00007FF7B3C7420A

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction ID: 75dbbb9357db5810ed2ba0f99d37b3b33a7e8c2305152ed642720f7e4ff1e777
Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction Fuzzy Hash: DEB2E972A18282CBE7A49EA8D4487FDB7A1FB65345F805135DF0D67ACCDB38A940CB50

Function 00007FF7B3C5ACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid distances set, xrefs: 00007FF7B3C5B1A0
invalid bit length repeat, xrefs: 00007FF7B3C5B099
invalid distance code, xrefs: 00007FF7B3C5B5B4
invalid code lengths set, xrefs: 00007FF7B3C5AE2D
too many length or distance symbols, xrefs: 00007FF7B3C5AE46
invalid literal/length code, xrefs: 00007FF7B3C5B3E2
invalid code -- missing end-of-block, xrefs: 00007FF7B3C5B0C6
invalid distance too far back, xrefs: 00007FF7B3C5B670
invalid literal/lengths set, xrefs: 00007FF7B3C5B133

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction ID: 16e745b81f91d07ae4085c418af57c64d3b97b56bf8f21f6802a8c627e79b3bc
Opcode Fuzzy Hash: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction Fuzzy Hash: 74523272A182A64BD7E49F18C44DA7E7BA9FB95300F42413AE74A937C4DF38D880CB50

Function 00007FF7B3C5D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7B3C5D148
RtlCaptureContext.KERNEL32 ref: 00007FF7B3C5D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7B3C5D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7B3C5D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF7B3C5D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7B3C5D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7B3C5D24C

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: 6d06b7ed7ca304e1a0d0994e705391fd23b2359226af580637bbbdf377994822
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 1C314172609B81C6EBA09FA4E8483EEB360FB95705F44403ADB4E57B99DF38D588C710

Function 00007FF7B3C6A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7B3C6A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7B3C6A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7B3C6A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF7B3C6A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7B3C6A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7B3C6A72E

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: 91c17327ccabd2f6ad10895b6dc70e0e720b700ef9258c9cec37bd3cf8ee2ef7
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 02319236608B8185DBA0DF69E8482AEB3A0FB95758F900135EB9D53B99DF3CD185CB10

Function 00007FF7B3C71874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C718C0
FindFirstFileExW.KERNEL32 ref: 00007FF7B3C719CA

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction ID: d978a5958470bfa1d265520686d6d6ca4a802294de81c4ac92f9c111783c42cb
Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction Fuzzy Hash: B5B1ED62B1868281EAA0BFA995081B9E350EF66BE5F846131DF5D67BCDDF3CD481C310

Function 00007FF7B3C5D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7B3C5D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF7B3C5D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF7B3C5D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF7B3C5D066

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 7c744b44f67568ade06d857966a6b2ce1b50fe3516a21d308dcae46b8af41473
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: 06114F22B14B05CAEB409BB4E8482B973A4F76A758F440E31DF1D567A8DF38D1948350

Function 00007FF7B3C73C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7B3C73C76
memcpy_s.LIBCPMT ref: 00007FF7B3C73CA1

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 0d61c1320a0ace7da27638f23ab84908072198d457543842f3d9c29c555acd45
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: A2C11672B18286C7E764DF5AA04866AF7A1F7A5B85F808134DF4E53788DB3DE841CB40

Function 00007FF7B3C5A47B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF7B3C5A4C5
, xrefs: 00007FF7B3C5A55B
header crc mismatch, xrefs: 00007FF7B3C5A921

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction ID: 01f8f18f60b4c66f8c2519c80bd8d41da01cf2a3625c29fac2fe7901dd21d0c5
Opcode Fuzzy Hash: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction Fuzzy Hash: 53F1D476A083C54BE7E6AF49808DA3ABAA9EF56740F464136DB4D273D4CB38D480C750

Function 00007FF7B3C79728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7B3C79977
RaiseException.KERNEL32 ref: 00007FF7B3C79988

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction ID: 30f4ee94b8dedef9176c8a3d70c1364a13a716c8a7cef8664d3abe972cb5b463
Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction Fuzzy Hash: 71B15A73A04B89CAEB55CF2DC84A368BBA0F745B59F148921DF5D837A8CB39D491C710

Function 00007FF7B3C639A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7B3C63D54
, xrefs: 00007FF7B3C63B12

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction ID: 479e0b73dfc859e2dcb58cf19833258401134426b86b0fccf53474bbb1178092
Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction Fuzzy Hash: DAE1E832A1864241E7A4AF9D845813DB3A0FF66B48F945235DB0EA73E9DF39D8D1D320

Function 00007FF7B3C5A2DB Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF7B3C5A449
incorrect header check, xrefs: 00007FF7B3C5A462

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction ID: 57184d646d951bf090a6be2fce013b8bdad8fb72a650dfe2cbed10d25e645ff1
Opcode Fuzzy Hash: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction Fuzzy Hash: 5391D672A182C687E7E59F59C44DA3E7AA9FB52340F42413BDB4E567C8CB38E580CB10

Function 00007FF7B3C6DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF7B3C6E07A
e+000, xrefs: 00007FF7B3C6DFFD

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction ID: 6a259dd0a9ae0c4b4200353f07878177e33b6eb91bd080e6d2fbbbadca51b71d
Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction Fuzzy Hash: 2151BC62B186C146E7609E7D9908769FB91E766B90F888232CB5C87AC9CF3DD084C711

Function 00007FF7B3C6DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7B3C6DD9E

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: fc72b5a89313d7644bf46e9d3625559af39c3a45375764c4080104c402675f8b
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: BDA18A62B087C986EB61DF69A0087B9B790EB62784F408031DF4D977CADE3DD485D320

Function 00007FF7B3C68794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7B3C687B3

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction ID: 49896dc072a975f0f35dd79715afccf9fd3f085a3ac21d0a84307f3ba63ffe6a
Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction Fuzzy Hash: 9B51A401B0870241FAD8BAAE590917AD290AF66BD4FD85034DF0DA77DEEE3CF4C14264

Function 00007FF7B3C73480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7B3C73484

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction ID: bdc98aabc49189c60923a40d3c19b2c4f1623420a65606a74e01e5f439467b55
Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction Fuzzy Hash: D7B09B10E07A01C1E94537555C8E11453547F55701FD50134C50D54374DE2C34E55710

Function 00007FF7B3C635A0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction ID: 742a7b6d5045eb811d670649a23fab3aa407d954ba69f1e67af0ab1f73b2c69a
Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction Fuzzy Hash: 7ED1EB72A0864245EBE8AE6D854827DA3A0FF66B48F941135CF0DA77E9CF3DD481C760

Function 00007FF7B3C59800 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction ID: 5745093a90efee2c5868ff4e37d6bda44b82c17b148d43e502bca944e7f96bc6
Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction Fuzzy Hash: 4DC18E762181E08BD289EB29E47947A7391F79A30DBD5406BEF87476C5C73CA414DB20

Function 00007FF7B3C62C10 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction ID: 7fc0bb67e2146e93b50b70cbbf2af88bc002ba5916d07325b485594c217233e9
Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction Fuzzy Hash: A1B1BE7290878586E7A49F6DC05823CBBA0E76AF48FA40135CB4EA73D9CF39D481C721

Function 00007FF7B3C6E570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction ID: a45a95d6fda4abf6b4b8f1158c4e654495ac2e2fc7cce64f614133f583633f41
Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction Fuzzy Hash: 1481F572A0C78146D7B4EF6D964836AA691FB66794F904236DB8D93BCDDF3CD0808B10

Function 00007FF7B3C76418 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
Instruction ID: 2c779a27d6ff63d999405536db4c8667425697e9babe1ffe3322247273999f3c
Opcode Fuzzy Hash: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
Instruction Fuzzy Hash: 80610B22E08242D6F7F4BAAD945863CE680AF62761FD44239DF1D536CDDE7DE8908720

Function 00007FF7B3C62164 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 7a89a3227833a380e8637ef0b6719c67e87e5d246d973af45fd3b818e20c0380
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 2E51BC36A1865681E7A49F6DC44823873A1FB66B68F644131CF4DA77D8CB3AEC83C750

Function 00007FF7B3C61944 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 0d04b18635ae7538a03fd3852ab739991972ef79c324d6a179f41161dcdb1146
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: B851DC72A1865181E7A49B6DC04823873A0EB66F59F646131CF8DA77DDCF3AE883C750

Function 00007FF7B3C61D54 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: ae6d8ef317094e99c761e208819fd8e7f88936b3808aff9c134f1107aa49ee48
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: EC51E836A1865182E7A49B6DC04833C73A0EB66F59F646131CF4DA77D9CB3AE883C750

Function 00007FF7B3C61B50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: 98f97de0fb9ec434555ac2c2cb13561fbe3f4b303c6c6b487268a3103d5114e8
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: C651F572A1865185E7A49F6DC04823C77A0EBA6B59F646131CF4CA77D8CF3AE883C750

Function 00007FF7B3C61F60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: bf3434a86910bcdff8cd44d29e5a846385f05b9b150cc3de3e0e946e684b9ce2
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 5451D836A18A5181E7A49F6DC448238B3A0EB66B58F645031CF4CA77DDCB3AEC83C750

Function 00007FF7B3C61740 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: feb23bbc3c37a183213ac5cefc1f993ce01ea798d972562976b799f0b0d3098d
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: A951C537A1865185E7A49B6DC04823873A0EB6AB59F646131CF4CA77D8CF3AE882C750

Function 00007FF7B3C65D30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 7a72b2a71e0ef9d512114631a0a3ac1047893dc9de7ff043dba807903155c16b
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 7C416362D0974A05EDD9999C060C6BCA6809F337A0EF852B4DFADB73DBC91D6DC6C120

Function 00007FF7B3C69EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 07c5c3dbe7f652372bb57e695467c808b7b79e3c34a572c983aa492810c51ea1
Instruction ID: d9932d511d1dfdd077e6a03e0cf293a1da5e17111f7b52f14aa33c078d53861f
Opcode Fuzzy Hash: 07c5c3dbe7f652372bb57e695467c808b7b79e3c34a572c983aa492810c51ea1
Instruction Fuzzy Hash: C2412562714A5582EF44DF6ED918169B391FB59FC4B899432EF0DA7B98DF3DC0828300

Function 00007FF7B3C680E4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: cf1e31b8b3e95ba4d80256ad7929be1f50df5fd7617bc8eb22efadc6352013a3
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: A731F832708B4181E794AF69644417DB6D8AF96BD0F544238EF4DA3BD9DF3CE0418714

Function 00007FF7B3C79570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: 3659f4a4b3ab2f0bef0951179df46935419e7dc7e04cf33807d01cc04309120f
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: 03F068717582958BDBD9DFADA44262977D0F7983C0F848139D68D83B58DB3CD0928F14

Function 00007FF7B3C5D30C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction ID: 66b53f7890b9a38e1cfee106e2a23b3450e5140a18052e904bc40d079425a84a
Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction Fuzzy Hash: 47A0012190D90AD0E684AB88A899035A230BB76305BC10072E60E614E99E2CA4889260

Function 00007FF7B3C576C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7B3C576D7
GetLastError.KERNEL32 ref: 00007FF7B3C576E9
GetProcAddress.KERNEL32 ref: 00007FF7B3C57725
GetLastError.KERNEL32 ref: 00007FF7B3C57737
GetProcAddress.KERNEL32 ref: 00007FF7B3C57750
GetLastError.KERNEL32 ref: 00007FF7B3C57762
GetProcAddress.KERNEL32 ref: 00007FF7B3C5777B
GetLastError.KERNEL32 ref: 00007FF7B3C5778D
GetProcAddress.KERNEL32 ref: 00007FF7B3C577A9
GetLastError.KERNEL32 ref: 00007FF7B3C577BB
GetProcAddress.KERNEL32 ref: 00007FF7B3C577D7
GetLastError.KERNEL32 ref: 00007FF7B3C577E9
GetProcAddress.KERNEL32 ref: 00007FF7B3C57805
GetLastError.KERNEL32 ref: 00007FF7B3C57817
GetProcAddress.KERNEL32 ref: 00007FF7B3C57833
GetLastError.KERNEL32 ref: 00007FF7B3C57845
GetProcAddress.KERNEL32 ref: 00007FF7B3C57861
GetLastError.KERNEL32 ref: 00007FF7B3C57873

Strings

Tcl_Alloc, xrefs: 00007FF7B3C57C1D, 00007FF7B3C57C3F
Tcl_CreateInterp, xrefs: 00007FF7B3C5771B, 00007FF7B3C5773D
Tk_GetNumMainWindows, xrefs: 00007FF7B3C57CA7, 00007FF7B3C57CC9
Tcl_SetVar2Ex, xrefs: 00007FF7B3C57B37, 00007FF7B3C57B59
Tcl_GetString, xrefs: 00007FF7B3C57AAD, 00007FF7B3C57ACF
Tcl_GetVar2, xrefs: 00007FF7B3C57A23, 00007FF7B3C57A45
Tcl_ConditionFinalize, xrefs: 00007FF7B3C5793D, 00007FF7B3C5795F
Tcl_MutexFinalize, xrefs: 00007FF7B3C5790F, 00007FF7B3C57931
Tcl_NewByteArrayObj, xrefs: 00007FF7B3C57B09, 00007FF7B3C57B2B
Tcl_GetCurrentThread, xrefs: 00007FF7B3C57857, 00007FF7B3C57879
Tcl_Init, xrefs: 00007FF7B3C576D0, 00007FF7B3C576EF
Tcl_MutexLock, xrefs: 00007FF7B3C578B3, 00007FF7B3C578D5
Tcl_EvalFile, xrefs: 00007FF7B3C57B93, 00007FF7B3C57BB5
Tcl_JoinThread, xrefs: 00007FF7B3C57885, 00007FF7B3C578A7
Tcl_ConditionNotify, xrefs: 00007FF7B3C5796B, 00007FF7B3C5798D
Tcl_GetObjResult, xrefs: 00007FF7B3C57B65, 00007FF7B3C57B87
GetProcAddress, xrefs: 00007FF7B3C576FF
Tcl_Finalize, xrefs: 00007FF7B3C5779F, 00007FF7B3C577C1
Tcl_CreateObjCommand, xrefs: 00007FF7B3C57A7F, 00007FF7B3C57AA1
Tcl_DeleteInterp, xrefs: 00007FF7B3C577FB, 00007FF7B3C5781D
Tcl_FindExecutable, xrefs: 00007FF7B3C57746, 00007FF7B3C57768
Tcl_Free, xrefs: 00007FF7B3C57C4B, 00007FF7B3C57C6D
Tcl_EvalObjv, xrefs: 00007FF7B3C57BEF, 00007FF7B3C57C11
Tcl_MutexUnlock, xrefs: 00007FF7B3C578E1, 00007FF7B3C57903
Tcl_SetVar2, xrefs: 00007FF7B3C57A51, 00007FF7B3C57A73
Tcl_DoOneEvent, xrefs: 00007FF7B3C57771, 00007FF7B3C57793
Tcl_EvalEx, xrefs: 00007FF7B3C57BC1, 00007FF7B3C57BE3
Tcl_FinalizeThread, xrefs: 00007FF7B3C577CD, 00007FF7B3C577EF
Tcl_CreateThread, xrefs: 00007FF7B3C57829, 00007FF7B3C5784B
Tcl_ConditionWait, xrefs: 00007FF7B3C57999, 00007FF7B3C579BB
Tcl_ThreadAlert, xrefs: 00007FF7B3C579F5, 00007FF7B3C57A17
Tcl_NewStringObj, xrefs: 00007FF7B3C57ADB, 00007FF7B3C57AFD
Tk_Init, xrefs: 00007FF7B3C57C79, 00007FF7B3C57C9B
Tcl_ThreadQueueEvent, xrefs: 00007FF7B3C579C7, 00007FF7B3C579E9
Failed to get address for %hs, xrefs: 00007FF7B3C576F8

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: 16d60a62a424ed4d60223bb5aed7ed264de957536f2bc9b751a18fdf8e258cb4
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: A402AB6490EB07C1EAC5BBDDA81D574A261AF26746FD51131DA1E322ECEF3CB5C98220

Function 00007FF7B3C581D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B3C59390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7B3C545F4,00000000,00007FF7B3C51985), ref: 00007FF7B3C593C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7B3C586B7,?,?,00000000,00007FF7B3C53CBB), ref: 00007FF7B3C5822C

Part of subcall function 00007FF7B3C52810: MessageBoxW.USER32 ref: 00007FF7B3C528EA

Strings

LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7B3C58373
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7B3C582D9
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7B3C58240
\, xrefs: 00007FF7B3C58261
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7B3C58203
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7B3C5829D
CreateDirectory, xrefs: 00007FF7B3C5837C
%.*s, xrefs: 00007FF7B3C5830C

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction ID: 4473b7c34878b211602681b1c69480396758950116e7c9690320ca2bbe7d3b31
Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction Fuzzy Hash: 5A518811B1964281E6D0BBACD85E2B9E250AF76780FC54432DB0E626DDEE2CF5848360

Function 00007FF7B3C52180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7B3C521AB
SelectObject.GDI32 ref: 00007FF7B3C521F2
DrawTextW.USER32 ref: 00007FF7B3C52215
SelectObject.GDI32 ref: 00007FF7B3C5222B
ReleaseDC.USER32 ref: 00007FF7B3C5223B
MoveWindow.USER32 ref: 00007FF7B3C5228B
MoveWindow.USER32 ref: 00007FF7B3C522CB
MoveWindow.USER32 ref: 00007FF7B3C5231E
MoveWindow.USER32 ref: 00007FF7B3C52366

Strings

P%, xrefs: 00007FF7B3C521FF

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 94f815a0b936fdcf7090119a4db51ecc498bb651fc0e8f0e57adb77c3250663b
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 205108266047A186D6749F26E41C1BAF7A1FBA9B61F004125EFDE43694DF3CD085DB20

Function 00007FF7B3C580C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7B3C580FF
GetWindowLongPtrW.USER32 ref: 00007FF7B3C5817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF7B3C58192
GetLastError.KERNEL32 ref: 00007FF7B3C5819C
SetWindowLongPtrW.USER32 ref: 00007FF7B3C581B3

Strings

Needs to remove its temporary files., xrefs: 00007FF7B3C58185

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 47ef767a3b61cc62bf83fdd934bb9127d4ba3ef0950b025d7a034f325ec7a176
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 37217621B08A42C2E7816BFEA84D179A250FF96B91F994131DF2E533DCDE2CE5D18324

Function 00007FF7B3C66290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C662D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C666C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C6695C

Strings

:, xrefs: 00007FF7B3C6648C
-, xrefs: 00007FF7B3C66369
p, xrefs: 00007FF7B3C66385
p, xrefs: 00007FF7B3C663FD
f, xrefs: 00007FF7B3C663F5

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 997382328d551ac90675d67503e0f2309dfcc4914edaafd935f293d37c6fd4f5
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 2912A472E08243A6FBA07A99E118279F651EB63750FC44135D789976CCDF3CE5E08B24

Function 00007FF7B3C60FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C61008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C613D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C6166F

Strings

f, xrefs: 00007FF7B3C6110A
p, xrefs: 00007FF7B3C610AD
p, xrefs: 00007FF7B3C61112
f, xrefs: 00007FF7B3C61255
f, xrefs: 00007FF7B3C610A0

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 540e7af1dce3d02d913ff8c0034245ed4614d1bebe815ebecb4a471c76409b74
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 1C129772E0C14386FBA0BA99D058279F6A1FBA2755FC45035D79A976CCDB3CE4C08B60

Function 00007FF7B3C51050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7B3C511F6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7B3C51108
fseek, xrefs: 00007FF7B3C510D3
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7B3C51098
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7B3C510CC
malloc, xrefs: 00007FF7B3C5110F
fread, xrefs: 00007FF7B3C511FD

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: d887d44ea8411714a319a2ddb58e34d6532429a931d40157cb204db5ad1c3ab0
Instruction ID: f849588a2491b33499a2b1b4d6304c37fd60c5bbc7fa52d33d3fdb1970b00428
Opcode Fuzzy Hash: d887d44ea8411714a319a2ddb58e34d6532429a931d40157cb204db5ad1c3ab0
Instruction Fuzzy Hash: E7419322A0855281EA80FB99981D5BAE394FF66BC4FC54432EF0C677CDDE3CE5818760

Function 00007FF7B3C51470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7B3C515DF
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7B3C51518
fseek, xrefs: 00007FF7B3C514E5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7B3C5149F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7B3C514DE
malloc, xrefs: 00007FF7B3C5151F
fread, xrefs: 00007FF7B3C515E6

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 04eae6a6e28014538c265d314aaf186d5e7ccf6377acaf4908732b6d0be74f73
Instruction ID: 08f8945f35320285fcb4346979f7401b7f6c5792dc5bf7e18594a1e54d1f69db
Opcode Fuzzy Hash: 04eae6a6e28014538c265d314aaf186d5e7ccf6377acaf4908732b6d0be74f73
Instruction Fuzzy Hash: 08418321A0854285EE80FFA994191B9E390AF66794FC54832EF0D677DDDE3CE581C720

Function 00007FF7B3C5EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7B3C5EA65

Part of subcall function 00007FF7B3C5F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF7B3C5F9FF
Part of subcall function 00007FF7B3C5F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7B3C5FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7B3C5EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7B3C5ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7B3C5EE98

Strings

csm, xrefs: 00007FF7B3C5EA7F
csm, xrefs: 00007FF7B3C5EAE6
csm, xrefs: 00007FF7B3C5EB60

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: ba31c4511fdfc2ea176533503db9b925f7ff3f875356967e74b0e91ea94f38d3
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 9DD1612290874185EBA0ABBD944A3BDB7A0FB66788F510136DF4D6779ADF38E0C4C711

Function 00007FF7B3C52C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B3C53706,?,00007FF7B3C53804), ref: 00007FF7B3C52C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B3C53706,?,00007FF7B3C53804), ref: 00007FF7B3C52D63
MessageBoxW.USER32 ref: 00007FF7B3C52D99

Strings

<FormatMessageW failed.>, xrefs: 00007FF7B3C52D70
[PYI-%d:ERROR] , xrefs: 00007FF7B3C52CA6
%ls: , xrefs: 00007FF7B3C52D22
Error, xrefs: 00007FF7B3C52D8C

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: 5c8245ed5d686ca998c5b45913c2c10cbd93d106ac65baeaec793f72d1947c07
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: 26311A22708A4042E660BB69A8092BBB691BF957C8F814136DF4D6379DDF3CD586C310

Function 00007FF7B3C5DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7B3C5DF7A,?,?,?,00007FF7B3C5DC6C,?,?,?,00007FF7B3C5D869), ref: 00007FF7B3C5DD4D
GetLastError.KERNEL32(?,?,?,00007FF7B3C5DF7A,?,?,?,00007FF7B3C5DC6C,?,?,?,00007FF7B3C5D869), ref: 00007FF7B3C5DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7B3C5DF7A,?,?,?,00007FF7B3C5DC6C,?,?,?,00007FF7B3C5D869), ref: 00007FF7B3C5DD85
FreeLibrary.KERNEL32(?,?,?,00007FF7B3C5DF7A,?,?,?,00007FF7B3C5DC6C,?,?,?,00007FF7B3C5D869), ref: 00007FF7B3C5DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF7B3C5DF7A,?,?,?,00007FF7B3C5DC6C,?,?,?,00007FF7B3C5D869), ref: 00007FF7B3C5DDFF

Strings

api-ms-, xrefs: 00007FF7B3C5DD6D

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: c9b552db6d1bb766d972eb34f9d201ff8dd5009625df7f7d204d7d17558e9e66
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 4A31B721B19701D1EE91BB8A940D175A394FF66B90FDA0536DF1D563C8EE3CE4848230

Function 00007FF7B3C56360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF7B3C56456
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7B3C56407
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7B3C563C7
ucrtbase.dll, xrefs: 00007FF7B3C563DD
LoadLibrary, xrefs: 00007FF7B3C564AE
Failed to load Python DLL '%ls'., xrefs: 00007FF7B3C564A7

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction ID: 8b692035e436bb97db814ed4f4fea9a8a85a97e455aebc5ef0d5cdc6fb33f846
Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction Fuzzy Hash: 0F419121A1868691EA50FBA8E41E1F9A311FB66344FC14133EB5C232DADF3CE595C360

Function 00007FF7B3C52A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7B3C5351A,?,00000000,00007FF7B3C53F1B), ref: 00007FF7B3C52AA0

Strings

0, xrefs: 00007FF7B3C52B16
Warning, xrefs: 00007FF7B3C52B1E
[PYI-%d:%s] , xrefs: 00007FF7B3C52AA8
WARNING, xrefs: 00007FF7B3C52AAF
Warning [ANSI Fallback], xrefs: 00007FF7B3C52B0F

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 1bbb40c60a4bc58c18098b3612355bcede45f113cb38361d8ad5fa5398c260c6
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 5721913261878192E760AB99F4497E6B394FB99384F804132EF8D6369DDF3CD1858750

Function 00007FF7B3C6B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7B3C6B15F
FlsGetValue.KERNEL32 ref: 00007FF7B3C6B174
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B195
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B1C2
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B1D3
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B1E4
SetLastError.KERNEL32 ref: 00007FF7B3C6B1FF

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction ID: 8b166bfebc305ee8280acaf49bc7d57ade1c310229ebd09489ad6bfd9aefab28
Opcode Fuzzy Hash: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction Fuzzy Hash: 70216D20B0C64281FAD873FE965D13DD2825F667A0F904634DB2EA76CEDE2DB4C14320

Function 00007FF7B3C77D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7B3C77D9D
GetLastError.KERNEL32 ref: 00007FF7B3C77DA9
CloseHandle.KERNEL32 ref: 00007FF7B3C77DC1
CreateFileW.KERNEL32 ref: 00007FF7B3C77DEC
WriteConsoleW.KERNEL32 ref: 00007FF7B3C77E0B

Strings

CONOUT$, xrefs: 00007FF7B3C77DCD

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: 4048fc2987edd5c2e8156e35978a8ec6c283135a5145b0090c9cd49cb9db0b3b
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 0011EB21A18A4186E7905B99E44C335B2A0FB59BE1F400234DF1D977D8CF3CD9808750

Function 00007FF7B3C58ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF7B3C53FA9), ref: 00007FF7B3C58EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF7B3C53FA9), ref: 00007FF7B3C58F5A

Part of subcall function 00007FF7B3C59390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7B3C545F4,00000000,00007FF7B3C51985), ref: 00007FF7B3C593C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7B3C53FA9), ref: 00007FF7B3C58FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7B3C53FA9), ref: 00007FF7B3C59044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7B3C53FA9), ref: 00007FF7B3C59055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7B3C53FA9), ref: 00007FF7B3C5906A

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction ID: 979c67733a0adcf528c57302450f636bc795e95a526e9fc4c10eb766de6d2b0a
Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction Fuzzy Hash: C641FA22B1968181EAB0AB55A4092BAB394FF9ABC4F854536DF4DA77CDDF3CD180C710

Function 00007FF7B3C6B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7B3C64F11,?,?,?,?,00007FF7B3C6A48A,?,?,?,?,00007FF7B3C6718F), ref: 00007FF7B3C6B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C64F11,?,?,?,?,00007FF7B3C6A48A,?,?,?,?,00007FF7B3C6718F), ref: 00007FF7B3C6B30D
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C64F11,?,?,?,?,00007FF7B3C6A48A,?,?,?,?,00007FF7B3C6718F), ref: 00007FF7B3C6B33A
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C64F11,?,?,?,?,00007FF7B3C6A48A,?,?,?,?,00007FF7B3C6718F), ref: 00007FF7B3C6B34B
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C64F11,?,?,?,?,00007FF7B3C6A48A,?,?,?,?,00007FF7B3C6718F), ref: 00007FF7B3C6B35C
SetLastError.KERNEL32(?,?,?,00007FF7B3C64F11,?,?,?,?,00007FF7B3C6A48A,?,?,?,?,00007FF7B3C6718F), ref: 00007FF7B3C6B377

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction ID: 0e134783679fb627603b1d3e9e8b3dba043dda7923cd6cec83aeb97e088b79a9
Opcode Fuzzy Hash: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction Fuzzy Hash: 9B113020B0C64281FAD477FE565D13DD2419FA67B0F944634DB2EA76DEDE6CA4814320

Function 00007FF7B3C52910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7B3C51B6A), ref: 00007FF7B3C5295E

Strings

Error [ANSI Fallback], xrefs: 00007FF7B3C529FF
%s: %s, xrefs: 00007FF7B3C529E8
[PYI-%d:ERROR] , xrefs: 00007FF7B3C52966
Error, xrefs: 00007FF7B3C52A0E

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: 5ec517839e3f72287d8735ed5dca443fc5637064c09c832755b6606a3245c5ae
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: 7B31E722B1868152E750BBA9A8492F7B294BF957D4F814132EF8DA378DDF3CD586C210

Function 00007FF7B3C52390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7B3C523C8
DialogBoxIndirectParamW.USER32 ref: 00007FF7B3C5248E
DeleteObject.GDI32 ref: 00007FF7B3C524C1
DestroyIcon.USER32 ref: 00007FF7B3C524D3

Strings

Unhandled exception in script, xrefs: 00007FF7B3C523F8

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction ID: 963f92ebf7390bb933a347c45fde3facf4602241043e9a66e25aa4f8b4c7b74c
Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction Fuzzy Hash: 3531607661968184EB60AFA5E8592FAA390FF9A784F800135EF4D57B8DDF3CD1808710

Function 00007FF7B3C52B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF7B3C5918F,?,00007FF7B3C53C55), ref: 00007FF7B3C52BA0
MessageBoxW.USER32 ref: 00007FF7B3C52C2A

Strings

[PYI-%d:%ls] , xrefs: 00007FF7B3C52BA8
WARNING, xrefs: 00007FF7B3C52BAF
Warning, xrefs: 00007FF7B3C52C1D

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: 4142753221cb55f3d67f72a9499f753b9a25ea5dead2623ad0bdcc573d8cbd57
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: 7721D622708B4181E750AB98F4497AAB394EB99784F804136EF4D63699DF3CD285C750

Function 00007FF7B3C52710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7B3C51B99), ref: 00007FF7B3C52760

Strings

Error [ANSI Fallback], xrefs: 00007FF7B3C527CF
ERROR, xrefs: 00007FF7B3C5276F
[PYI-%d:%s] , xrefs: 00007FF7B3C52768
Error, xrefs: 00007FF7B3C527DE

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: f69ad2ecf8a1a02a0d497b7f379964aa1ea7bac998a7c10bfd96a1f6726751d6
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: 65219132A1878192E750AB99F4497E6A394EB99384F800132EF8D6369DDF7CD1858750

Function 00007FF7B3C69A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7B3C69AAD
GetProcAddress.KERNEL32 ref: 00007FF7B3C69AC3
FreeLibrary.KERNEL32 ref: 00007FF7B3C69AEA

Strings

mscoree.dll, xrefs: 00007FF7B3C69AA4
CorExitProcess, xrefs: 00007FF7B3C69ABC

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: c01c6fcc90ef4c949bffe6cae5fe0a8a1ddcdc1995f5d4f508416bba7752aa3a
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: 25F0686170970681EA50AB98E84C376A360AF56761F940235DB6E565ECDF3CD1C5D320

Function 00007FF7B3C79368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7B3C79390
_set_statfp.LIBCMT ref: 00007FF7B3C793AB
_set_statfp.LIBCMT ref: 00007FF7B3C793C7
_set_statfp.LIBCMT ref: 00007FF7B3C79403

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 7e1cbec7e533feb0274d7040c3cce9be04d8b25e07edd9180ee80c54c9af6e4c
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: D9116332D58A0281F6D471EDE49A3799051AF7B375F840634EF6F362DE8E6CA8C14130

Function 00007FF7B3C6B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7B3C6A5A3,?,?,00000000,00007FF7B3C6A83E,?,?,?,?,?,00007FF7B3C6A7CA), ref: 00007FF7B3C6B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C6A5A3,?,?,00000000,00007FF7B3C6A83E,?,?,?,?,?,00007FF7B3C6A7CA), ref: 00007FF7B3C6B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C6A5A3,?,?,00000000,00007FF7B3C6A83E,?,?,?,?,?,00007FF7B3C6A7CA), ref: 00007FF7B3C6B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C6A5A3,?,?,00000000,00007FF7B3C6A83E,?,?,?,?,?,00007FF7B3C6A7CA), ref: 00007FF7B3C6B407
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C6A5A3,?,?,00000000,00007FF7B3C6A83E,?,?,?,?,?,00007FF7B3C6A7CA), ref: 00007FF7B3C6B418

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction ID: 7b264e1aea697005ab8db6ee4820bbcdb21837caf56e0d3494a22ffa50c5979b
Opcode Fuzzy Hash: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction Fuzzy Hash: 5B113020F08A4242FAD8B7EE5559179D2415F667B0FD84734DB2DA76DEDE2CE4C14220

Function 00007FF7B3C6B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7B3C6B235
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B254
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B27C
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B28D
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B29E

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction ID: 3aa0c9cb80d076d2cd37a4ba2c3b5618ef16a5fd79edd66d556817633b589204
Opcode Fuzzy Hash: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction Fuzzy Hash: 4111F560A0860741FAE872FE445917D93824F67320F944734DB2EEB6CADE2CB4C042B1

Function 00007FF7B3C65FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C65FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C66106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C661BC

Strings

verbose, xrefs: 00007FF7B3C65FB0

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 8fe9f5f23edaabad3bfce04fe21e63f5255cc391dd80b8094a8b479fe883020e
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 2A910632A08A4651F7A0AEA8D45837DB794AB63B54FC44131DB9EE33C9DF3DE4958320

Function 00007FF7B3C6FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C6FEA7

Part of subcall function 00007FF7B3C67A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C67A59

Strings

ccs, xrefs: 00007FF7B3C6FDE2
UTF-8, xrefs: 00007FF7B3C6FE26
UTF-16LEUNICODE, xrefs: 00007FF7B3C6FE45

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: c94f6b54a7b53d696bb46c843d59797804344e27ea2c114fcc8ae99a5d4fa071
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: A9818376E0814285E7E57EAD8158278BBA0AB33B44FD54035CB09E72CEDB2DB9819321

Function 00007FF7B3C5D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7B3C5D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7B3C5D70A
RtlUnwindEx.KERNEL32 ref: 00007FF7B3C5D764

Strings

csm, xrefs: 00007FF7B3C5D6F1

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 489a86170379063bf3cd3e106093b1a4c86f3a081757d0b5a27455536ac1790d
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: CC51B032A197028ADB94AB59D40DA38B391EB65BC8F924132DB4E577CCDF3CE885C750

Function 00007FF7B3C5F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7B3C5F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7B3C5F398

Strings

csm, xrefs: 00007FF7B3C5F2D2
csm, xrefs: 00007FF7B3C5F3EA

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 7bffd6060d38a52a532ac091aaa3aa30a1cd673359b01c9202529d6605c98218
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: 5B518232608642C6EBA8ABA9914927CB790FB66B85F954137DF4C53BC9CF3CE490C711

Function 00007FF7B3C5EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7B3C5EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7B3C5EF83

Strings

RCC, xrefs: 00007FF7B3C5EF53
MOC, xrefs: 00007FF7B3C5EF4B

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: c698270e4f2c1c2d16c11559e46e39b959fbb80617f897b9fa8aed4c0ea4d2dd
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 8961A032908BC185D7A4AB69E4453BAB7A0FB96784F444226EF9C53B99CF7CD0D0CB10

Function 00007FF7B3C52810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7B3C528EA

Strings

ERROR, xrefs: 00007FF7B3C5286F
[PYI-%d:%ls] , xrefs: 00007FF7B3C52868
Error, xrefs: 00007FF7B3C528DD

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: c67b61c8ccc7c4d7f779b959cfd663679744c92290deb88d38e644b05b02d272
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: A121D362708B4181E750AB98F4497EAB3A0EB99784F804136EF8D6369ADF3CD285C750

Function 00007FF7B3C6C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7B3C6C61F
WriteFile.KERNEL32 ref: 00007FF7B3C6C8E7
WriteFile.KERNEL32 ref: 00007FF7B3C6C92D
GetLastError.KERNEL32 ref: 00007FF7B3C6C9E3

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: f3f8f3110ccb5ecca108310074bda3c2f6142132aab5c42c91eaa994bc00359a
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: 08D10572B08A4189E750DFB9D4441AC77B1FB66798B848236DF5DA7BCADE38D086C310

Function 00007FF7B3C520C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7B3C520F4
SetWindowLongPtrW.USER32 ref: 00007FF7B3C52116
GetWindowLongPtrW.USER32 ref: 00007FF7B3C52140
InvalidateRect.USER32 ref: 00007FF7B3C52160

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: f48bb2874f331df645a5bd0ba5858ccf2dcf1d8cd21cc05ebede968224ae3616
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: B011A921A1C14282F6D4ABEDE54D2BBD291EFA6780FC54031DF4917BDDCD2DD8D58610

Function 00007FF7B3C75B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B3C71760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C71793

_get_daylight.LIBCMT ref: 00007FF7B3C75C34
_get_daylight.LIBCMT ref: 00007FF7B3C75C45

Strings

?, xrefs: 00007FF7B3C75BC5

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction ID: e6b8a2159582a7ce3beeeace65f4d38f2e54003e56e018d92898c55fd5e38135
Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction Fuzzy Hash: 10411C12A0824185F7E4ABA99409379E750EBA27E5F944235EF6C17ADDDF3CD8C18710

Function 00007FF7B3C69014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C69046

Part of subcall function 00007FF7B3C6A948: RtlFreeHeap.NTDLL(?,?,?,00007FF7B3C72D22,?,?,?,00007FF7B3C72D5F,?,?,00000000,00007FF7B3C73225,?,?,?,00007FF7B3C73157), ref: 00007FF7B3C6A95E
Part of subcall function 00007FF7B3C6A948: GetLastError.KERNEL32(?,?,?,00007FF7B3C72D22,?,?,?,00007FF7B3C72D5F,?,?,00000000,00007FF7B3C73225,?,?,?,00007FF7B3C73157), ref: 00007FF7B3C6A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7B3C5CBA5), ref: 00007FF7B3C69064

Strings

C:\Users\user\Desktop\cPl7CoJTBx.exe, xrefs: 00007FF7B3C69052

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\cPl7CoJTBx.exe
API String ID: 3580290477-2922186201
Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction ID: 8fa9ce8d65cf2c5f7158b3a9acfcb9b193cd345d83de12f831f635a1e13d76a3
Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction Fuzzy Hash: DA41A735A08B0285E795FFA9D8480BCA3A4EF567D0B954035EB4DA37C9DE3DE4C18360

Function 00007FF7B3C6CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7B3C6CD4F
GetLastError.KERNEL32 ref: 00007FF7B3C6CD71

Strings

U, xrefs: 00007FF7B3C6CCFB

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: d7fa3282d13d3de43bcc43f3dd4121cda039b19314119a8e76932be0c9b7c8a6
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: 9E41C732718A4191D7A09FA9E4483B9B760FBA9784F908131EF4D97799EF3CD481C750

Function 00007FF7B3C6F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7B3C6F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7B3C6F64A

Strings

:, xrefs: 00007FF7B3C6F60E

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction ID: b87bd2e3f38b4ac0488f27b22677880de69ee90b18a3ca4c00c61874000cbdb0
Opcode Fuzzy Hash: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction Fuzzy Hash: 8321D572B0824181EBA0AB59D04C27DB3B1FBA5B44FC54035DB4DA36D8DF7CD5848761

Function 00007FF7B3C5FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7B3C5FD98
RaiseException.KERNEL32 ref: 00007FF7B3C5FDD9

Strings

csm, xrefs: 00007FF7B3C5FDC6

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: ef27b275bd2319b417d08c1fde4ed6a23c3643ba749fe8c065e82adee24811e2
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: E1115E32608B8582EB659F19E404269B7E4FB99B84F594231EF8D17798DF3CD5918B00

Function 00007FF7B3C7073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C7076C
GetDriveTypeW.KERNEL32 ref: 00007FF7B3C707AC

Strings

:, xrefs: 00007FF7B3C70795

Memory Dump Source

Source File: 00000000.00000002.2215999570.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000000.00000002.2215932833.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216097427.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216240047.00007FF7B3C92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2216434158.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 3ac7fce3e76c7c94538732f289e15589dd2d81275672eb41847e65b7befdfdae
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 4C01D821918202C6F7E0BFE894292BEA390EF66745FC01035DB4D932C9DF3CD5808B24

Analysis Process: cPl7CoJTBx.exePID: 6784, Parent PID: 5972COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.8%
Total number of Nodes:	838
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF8A82B1A0F Relevance: 144.4, APIs: 74, Strings: 8, Instructions: 858COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A82FACE7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82FACFF
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82FAE96
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82FAEAE
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FF8A82FAF96
EVP_CIPHER_get_flags.LIBCRYPTO-3 ref: 00007FF8A82FAF9E
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82FB00C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82FB024
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82FB191
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82FB1A9
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82FB1DA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82FB1F2
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FF8A82FB213
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF8A82FB220
CRYPTO_memcmp.LIBCRYPTO-3 ref: 00007FF8A82FB2AA
ERR_set_mark.LIBCRYPTO-3 ref: 00007FF8A82FB2C6
ERR_clear_last_mark.LIBCRYPTO-3 ref: 00007FF8A82FB315
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82FB31F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82FB337
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82FB496
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82FB4B5
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82FBA16
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82FBA2E
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82FBA40
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82FBA4C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82FBA64

Strings

ssl3_get_record, xrefs: 00007FF8A82FACF1, 00007FF8A82FAEA0, 00007FF8A82FB016, 00007FF8A82FB064, 00007FF8A82FB094, 00007FF8A82FB0BC, 00007FF8A82FB0E9, 00007FF8A82FB196, 00007FF8A82FB1DF, 00007FF8A82FB324, 00007FF8A82FB34C, 00007FF8A82FB3B8, 00007FF8A82FB439, 00007FF8A82FB593, 00007FF8A82FB743, 00007FF8A82FB7C2, 00007FF8A82FB7EF, 00007FF8A82FB821, 00007FF8A82FB855, 00007FF8A82FB887, 00007FF8A82FB973, 00007FF8A82FB9AD, 00007FF8A82FBA20, 00007FF8A82FBA51
GET , xrefs: 00007FF8A82FB8E8
HEAD , xrefs: 00007FF8A82FB929
CONNE, xrefs: 00007FF8A82FB95A
POST , xrefs: 00007FF8A82FB90B
, xrefs: 00007FF8A82FB187
PUT , xrefs: 00007FF8A82FB943
..\s\ssl\record\ssl3_record.c, xrefs: 00007FF8A82FACF8, 00007FF8A82FAEA7, 00007FF8A82FB01D, 00007FF8A82FB06B, 00007FF8A82FB09B, 00007FF8A82FB0C8, 00007FF8A82FB0F5, 00007FF8A82FB1A2, 00007FF8A82FB1EB, 00007FF8A82FB330, 00007FF8A82FB358, 00007FF8A82FB38F, 00007FF8A82FB3C4, 00007FF8A82FB445, 00007FF8A82FB489, 00007FF8A82FB4AB, 00007FF8A82FB74F, 00007FF8A82FB7CE, 00007FF8A82FB7FB, 00007FF8A82FB828, 00007FF8A82FB861, 00007FF8A82FB88E, 00007FF8A82FB97F, 00007FF8A82FB9B9, 00007FF8A82FBA27, 00007FF8A82FBA5D

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_new$R_set_debug$O_free$D_get_sizeO_memcmpR_clear_last_markR_get_flagsR_set_markX_get0_cipherX_get0_md
String ID: $..\s\ssl\record\ssl3_record.c$CONNE$GET $HEAD $POST $PUT $ssl3_get_record
API String ID: 2283737721-2781224710
Opcode ID: 40243567b0c9e5d0b1d25a9c0806e483eb2da45cb6c3cb4bcf6ca79101e842da
Instruction ID: 6536ce6116c9c1f63a83b2aa7ca991fc19f7da6b8f20169dfb4585c2701b3bb6
Opcode Fuzzy Hash: 40243567b0c9e5d0b1d25a9c0806e483eb2da45cb6c3cb4bcf6ca79101e842da
Instruction Fuzzy Hash: 8682CF31A0BA86A1FB609B21D4507BD26A0EF457C4F584036DA4D47ADDDFBCE8A1C738

Function 00007FF8A82CCD30 Relevance: 61.4, APIs: 34, Strings: 1, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82CCD94
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82CCDB6
CRYPTO_free_ex_data.LIBCRYPTO-3 ref: 00007FF8A82CCDE8
OPENSSL_LH_free.LIBCRYPTO-3 ref: 00007FF8A82CCDF1
X509_STORE_free.LIBCRYPTO-3 ref: 00007FF8A82CCDFA
CTLOG_STORE_free.LIBCRYPTO-3 ref: 00007FF8A82CCE06
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FF8A82CCE0F
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FF8A82CCE18
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FF8A82CCE21
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FF8A82CCE40
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FF8A82CCE53
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FF8A82CCE66
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FF8A82CCE79
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82CCEA6
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82CCEBF
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82CCED8
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82CCEF1
CRYPTO_secure_free.LIBCRYPTO-3 ref: 00007FF8A82CCF0A
EVP_MD_get0_provider.LIBCRYPTO-3 ref: 00007FF8A82CCF1E
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8A82CCF2B
EVP_MD_get0_provider.LIBCRYPTO-3 ref: 00007FF8A82CCF3F
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8A82CCF4C
EVP_CIPHER_get0_provider.LIBCRYPTO-3 ref: 00007FF8A82CCF6B
EVP_CIPHER_free.LIBCRYPTO-3 ref: 00007FF8A82CCF78
EVP_MD_get0_provider.LIBCRYPTO-3 ref: 00007FF8A82CCF9F
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8A82CCFAC
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82CCFE9
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82CD007
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82CD025
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82CD04E
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82CD067
CRYPTO_THREAD_lock_free.LIBCRYPTO-3 ref: 00007FF8A82CD073
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82CD08C
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82CD0A1

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A82CCD87, 00007FF8A82CCDA0, 00007FF8A82CCE99, 00007FF8A82CCEB2, 00007FF8A82CCECB, 00007FF8A82CCEE4, 00007FF8A82CCEFD, 00007FF8A82CCFD8, 00007FF8A82CCFF5, 00007FF8A82CD013, 00007FF8A82CD041, 00007FF8A82CD05A, 00007FF8A82CD07F, 00007FF8A82CD097

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: O_free$L_sk_free$D_freeD_get0_providerL_sk_pop_free$E_free$D_lock_freeH_freeO_free_ex_dataO_secure_freeR_freeR_get0_providerX509_
String ID: ..\s\ssl\ssl_lib.c
API String ID: 234229340-1080266419
Opcode ID: f7e90b002c0f20001dbf9e5a2de404a379799662cee41334dc9c8a45caab9bf3
Instruction ID: 9710dc2ba89177e580bb0359416b12a87dd0a745b3bb9872e07c2aef54a5f960
Opcode Fuzzy Hash: f7e90b002c0f20001dbf9e5a2de404a379799662cee41334dc9c8a45caab9bf3
Instruction Fuzzy Hash: 9A916161A1AE46A0FB50AF22D4506F82B21EF95FC8F4C1032DE5D4B69ADF2DE5418338

Function 00007FF7B3C51000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pkg, xrefs: 00007FF7B3C539BE
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF7B3C53882, 00007FF7B3C538AF
_PYI_ARCHIVE_FILE, xrefs: 00007FF7B3C538D2, 00007FF7B3C539FF
Failed to start splash screen!, xrefs: 00007FF7B3C53ECC
pyi-contents-directory, xrefs: 00007FF7B3C53B8D
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7B3C53D12
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7B3C53C61
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7B3C53BE8
pyi-runtime-tmpdir, xrefs: 00007FF7B3C53B68
Py_GIL_DISABLED, xrefs: 00007FF7B3C53AF4
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF7B3C53D35
pyi-python-flag, xrefs: 00007FF7B3C53AD6
VCRUNTIME140.dll, xrefs: 00007FF7B3C53DA9
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7B3C53E9E
Failed to load splash screen resources!, xrefs: 00007FF7B3C53E7D
Failed to remove temporary directory: %s, xrefs: 00007FF7B3C53FC7
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7B3C53971
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7B3C53EB3
_PYI_SPLASH_IPC, xrefs: 00007FF7B3C53A23, 00007FF7B3C53EED
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF7B3C53E02
Could not create temporary directory!, xrefs: 00007FF7B3C53CBF
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF7B3C53A17, 00007FF7B3C53A2F, 00007FF7B3C53A9B
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF7B3C53A0B, 00007FF7B3C53CD4, 00007FF7B3C53F63
MEI, xrefs: 00007FF7B3C53933
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF7B3C53B32
pyi-disable-windowed-traceback, xrefs: 00007FF7B3C53BB2
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7B3C539DE
Failed to convert DLL search path!, xrefs: 00007FF7B3C53DD4

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: b5ceb5b3e51986f255ddba2ad990e8dc75569a57b07797df16117ed6fd5ba839
Instruction ID: a9584ce3fd673464dbe752328a2047b97512c3e62203ef1ceb7da93a107916a4
Opcode Fuzzy Hash: b5ceb5b3e51986f255ddba2ad990e8dc75569a57b07797df16117ed6fd5ba839
Instruction Fuzzy Hash: 20327021B0C68291EB95B7A8945E3B9A651AF66780FC54033DB4D632DEDF2CF5D4C320

Function 00007FF7B3C76964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B3C76698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C766D9
Part of subcall function 00007FF7B3C76698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C76757
Part of subcall function 00007FF7B3C76698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C767A8

CreateFileW.KERNEL32 ref: 00007FF7B3C76A6A
CreateFileW.KERNEL32 ref: 00007FF7B3C76ABA
GetLastError.KERNEL32 ref: 00007FF7B3C76AEA
GetFileType.KERNEL32 ref: 00007FF7B3C76AFF
GetLastError.KERNEL32 ref: 00007FF7B3C76B09
CloseHandle.KERNEL32 ref: 00007FF7B3C76B3C
CloseHandle.KERNEL32 ref: 00007FF7B3C76C9F
CreateFileW.KERNEL32 ref: 00007FF7B3C76CD4
GetLastError.KERNEL32 ref: 00007FF7B3C76CE3

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: c9cf33d0bbf0bdbfd8c0dccb2242c80b88215a9462bc57630f9ddd37fcb7395d
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 03C1D232B28A41D5EB50EFA9C4942AC7761F75AB98B410235DF1EA77D8DF38D0A1C310

Function 00007FF7B3C59280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF7B3C592B3
FindClose.KERNEL32 ref: 00007FF7B3C592C2

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: f100b107018daa9a7eb4c0186988f4c2714df4559e6a539b1930a9fc636755a8
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 26F0A922A1864186F7E09BE8B48D776B350AB55328F850236DB6D11AD8DF3CD088C600

Function 00007FF8A8141230 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF8A8141255

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 0609f6becf4837133f86ac5623d419228c70d3b405efdb4a8828f98acc38b35e
Instruction ID: f81afdf687f24380d30333d6f14169601f6869b230a0b10ed11de219ed05d3f4
Opcode Fuzzy Hash: 0609f6becf4837133f86ac5623d419228c70d3b405efdb4a8828f98acc38b35e
Instruction Fuzzy Hash: EDA127A1E4BF47E5FE668B45A85437432A4FF44BC0F540536C98E467A8EF2CE480C368

Function 00007FF8A82B14BF Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8A830F1BC
SetLastError.KERNEL32 ref: 00007FF8A830F1C3
ERR_new.LIBCRYPTO-3 ref: 00007FF8A830F2A4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A830F2BC
ERR_new.LIBCRYPTO-3 ref: 00007FF8A830F2E5
ERR_new.LIBCRYPTO-3 ref: 00007FF8A830F30A
ERR_new.LIBCRYPTO-3 ref: 00007FF8A830F32C
ERR_new.LIBCRYPTO-3 ref: 00007FF8A830F34D
ERR_new.LIBCRYPTO-3 ref: 00007FF8A830F372
ERR_new.LIBCRYPTO-3 ref: 00007FF8A830F39B
ERR_new.LIBCRYPTO-3 ref: 00007FF8A830F44B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A830F463
ERR_new.LIBCRYPTO-3 ref: 00007FF8A830F47E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A830F496
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A830F4A8
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FF8A830F4B3

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FF8A830F2B5, 00007FF8A830F45C, 00007FF8A830F48F
state_machine, xrefs: 00007FF8A830F2AE, 00007FF8A830F450, 00007FF8A830F483

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_new$R_set_debug$ErrorLastM_freeR_clear_errorR_set_error
String ID: ..\s\ssl\statem\statem.c$state_machine
API String ID: 1370845099-1722249466
Opcode ID: 0d32384d7316208965964d29d91abcf0daa34d1bc1be83e9d84aa4d08f48a424
Instruction ID: f725c5fc3a083f05a2e5976f0b1e57e7bb87766f92d5eb0f47605c3cb3a9b574
Opcode Fuzzy Hash: 0d32384d7316208965964d29d91abcf0daa34d1bc1be83e9d84aa4d08f48a424
Instruction Fuzzy Hash: 78A17325A0EE43A6FBA4EAA5E4413BD22A4EF51BC4F1C4031DD4D466DADF3CE8418379

Function 00007FF7B3C51950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B3C57F90: _fread_nolock.LIBCMT ref: 00007FF7B3C5803A

_fread_nolock.LIBCMT ref: 00007FF7B3C51A1B

Part of subcall function 00007FF7B3C52910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7B3C51B6A), ref: 00007FF7B3C5295E

Strings

calloc, xrefs: 00007FF7B3C51A68
Failed to read cookie!, xrefs: 00007FF7B3C51A2B
Could not read full TOC!, xrefs: 00007FF7B3C51B55
Failed to seek to cookie position!, xrefs: 00007FF7B3C519EE
fseek, xrefs: 00007FF7B3C519F5
Could not allocate buffer for TOC!, xrefs: 00007FF7B3C51B1B
MEI, xrefs: 00007FF7B3C51991
Could not allocate memory for archive structure!, xrefs: 00007FF7B3C51A61
Error on file., xrefs: 00007FF7B3C51B8D
fread, xrefs: 00007FF7B3C51A32, 00007FF7B3C51B5C
malloc, xrefs: 00007FF7B3C51B22

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 27547418d9ab5e62463e202343d91a8db4d430f9fb0a7f3bbb020ab973e08554
Instruction ID: 3034098935f58f582c62af934678e8003971c9b4d8b9abb8e3aab44a60b9834f
Opcode Fuzzy Hash: 27547418d9ab5e62463e202343d91a8db4d430f9fb0a7f3bbb020ab973e08554
Instruction Fuzzy Hash: 7A81B371A0C68285EB90FBA8D05E2B9B390AF66744F815432DB4D637CDDE3CE5C58720

Function 00007FF8A830ECC0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FF8A830EF54, 00007FF8A830EF91, 00007FF8A830EFBE, 00007FF8A830F031
read_state_machine, xrefs: 00007FF8A830EF4D, 00007FF8A830EF8A, 00007FF8A830EFB2, 00007FF8A830F025

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem.c$read_state_machine
API String ID: 0-3323778802
Opcode ID: c8972936501a879b7e84c5051af7770807ba9d65b882bacb7b5450dec163fd8f
Instruction ID: a9c5b7f689881bff0cb5762e061654c4a71cb79f8674fb20741e3fe03149ce3d
Opcode Fuzzy Hash: c8972936501a879b7e84c5051af7770807ba9d65b882bacb7b5450dec163fd8f
Instruction Fuzzy Hash: 16916C22B0AA86A5FB50AB65E4543BD27A0EF40BC8F5C4036DA4D476D9DF3CE446C368

Function 00007FF8A830F6B0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3(?,?,FFFFFFFF,00000000,00007FF8A830F416), ref: 00007FF8A830F762
ERR_set_debug.LIBCRYPTO-3(?,?,FFFFFFFF,00000000,00007FF8A830F416), ref: 00007FF8A830F77A

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FF8A830F773, 00007FF8A830FA62
write_state_machine, xrefs: 00007FF8A830F76C, 00007FF8A830FA5B

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem.c$write_state_machine
API String ID: 193678381-552286378
Opcode ID: e5d1fe94fccde403d4ccffd35c49600b4c13cc4e7178492653a3fc2a8d140b00
Instruction ID: ae650af8e569e4107b0a8a13838f93a8551cba0815183cfe6f46d7069b6c1ab9
Opcode Fuzzy Hash: e5d1fe94fccde403d4ccffd35c49600b4c13cc4e7178492653a3fc2a8d140b00
Instruction Fuzzy Hash: 3AA18D32A0AA43A6EB64DF65D4543BD2360FB44BC8F484136CA4D436D9DF3CE946C729

Function 00007FF7B3C51470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7B3C514DE
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7B3C51518
fseek, xrefs: 00007FF7B3C514E5
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7B3C515DF
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7B3C5149F
fread, xrefs: 00007FF7B3C515E6
malloc, xrefs: 00007FF7B3C5151F

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 0415811bb7329ddca4e4a244178c4befdf0ff72a6341d4c7f046017dd740e2c3
Instruction ID: 08f8945f35320285fcb4346979f7401b7f6c5792dc5bf7e18594a1e54d1f69db
Opcode Fuzzy Hash: 0415811bb7329ddca4e4a244178c4befdf0ff72a6341d4c7f046017dd740e2c3
Instruction Fuzzy Hash: 08418321A0854285EE80FFA994191B9E390AF66794FC54832EF0D677DDDE3CE581C720

Function 00007FF7B3C51210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7B3C5141E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7B3C512EF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7B3C51276
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7B3C512BA
1.3.1, xrefs: 00007FF7B3C51249
malloc, xrefs: 00007FF7B3C512C1, 00007FF7B3C512F6

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 698b21169e7bd12c857e57f237555d9e116291535cd7e4395843bf29195d2337
Instruction ID: 5a7ca3ee6e16ea3ab0b66206c01aa2f2439dd58a2c4e732cb400b366517daa32
Opcode Fuzzy Hash: 698b21169e7bd12c857e57f237555d9e116291535cd7e4395843bf29195d2337
Instruction Fuzzy Hash: 1D51FA22A0864281EAA0BB99D4193B9A290FF66795FC55132EF4D677CDDF3CE481C710

Function 00007FF7B3C536B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7B3C53804), ref: 00007FF7B3C536E1
GetLastError.KERNEL32(?,00007FF7B3C53804), ref: 00007FF7B3C536EB

Part of subcall function 00007FF7B3C52C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B3C53706,?,00007FF7B3C53804), ref: 00007FF7B3C52C9E
Part of subcall function 00007FF7B3C52C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B3C53706,?,00007FF7B3C53804), ref: 00007FF7B3C52D63
Part of subcall function 00007FF7B3C52C50: MessageBoxW.USER32 ref: 00007FF7B3C52D99

Strings

GetModuleFileNameW, xrefs: 00007FF7B3C536FA
Failed to obtain executable path., xrefs: 00007FF7B3C536F3
Failed to resolve full path to executable %ls., xrefs: 00007FF7B3C53739
\\?\, xrefs: 00007FF7B3C5375A
Failed to convert executable path to UTF-8., xrefs: 00007FF7B3C53790

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: a46074bc1f8a5986d813807c8e67a93687f5f06b9e5cffd3054986fca8f5dd16
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 46219951F1854281FAA0B7A8D84E3B59250BF66385FC14133DB5DA65DEEF2CE584C710

Function 00007FF7B3C6BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C6BE89

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction ID: 339149b1a1b9e7bc21966c053e50a93e97ae6039aa8d36866a3be5dfc145d902
Opcode Fuzzy Hash: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction Fuzzy Hash: D0C1072290C68691E6A06FDA94482BDBB54FBA2B80FD50131DB4DA77DDCE7CE4C58720

Function 00007FF8A83215A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A83216C6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A83216DE
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8321761
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8321779

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8A83216D7, 00007FF8A8321772
tls_get_message_header, xrefs: 00007FF8A83216CB, 00007FF8A8321766

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$tls_get_message_header
API String ID: 193678381-2714770296
Opcode ID: f45773da2448751231a1ca749fc05bc9d2df97a6a3f744ec35cbeb086fc78321
Instruction ID: 6b7947c77e0de53145cf9f7afda9ca5db97f03b370daa35954bbf5c5e4d0ff0b
Opcode Fuzzy Hash: f45773da2448751231a1ca749fc05bc9d2df97a6a3f744ec35cbeb086fc78321
Instruction Fuzzy Hash: 19616D32A09B82A5EB609F25E5503BD37A0FB95B88F1C4036DB8D47795EF3CE4548728

Function 00007FF7B3C56360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ucrtbase.dll, xrefs: 00007FF7B3C563DD
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7B3C56407
LoadLibrary, xrefs: 00007FF7B3C564AE
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF7B3C56456
Failed to load Python DLL '%ls'., xrefs: 00007FF7B3C564A7
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7B3C563C7

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction ID: 8b692035e436bb97db814ed4f4fea9a8a85a97e455aebc5ef0d5cdc6fb33f846
Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction Fuzzy Hash: 0F419121A1868691EA50FBA8E41E1F9A311FB66344FC14133EB5C232DADF3CE595C360

Function 00007FF8A82CFD40 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A82CFD62
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82CFD7A
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A82CFD8C
ASYNC_get_current_job.LIBCRYPTO-3 ref: 00007FF8A82CFDDB

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A82CFD73
SSL_do_handshake, xrefs: 00007FF8A82CFD67

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: C_get_current_jobR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_do_handshake
API String ID: 2134390360-2964568172
Opcode ID: 3e19f5133db6f9f0995d995d45ee5f37c3958f709a5efffcd3d50ec949d9a66b
Instruction ID: 44e52d639e1387fbcf80a6bfcbbba3aaf278c2701a34f9cc2d49a3178932ef29
Opcode Fuzzy Hash: 3e19f5133db6f9f0995d995d45ee5f37c3958f709a5efffcd3d50ec949d9a66b
Instruction Fuzzy Hash: ED21B322F0AB4662FB50AB35E4013B96351EF887D4F5C1231EA8D077DADF3CE4918668

Function 00007FF7B3C65628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C65655
CreateFileW.KERNEL32 ref: 00007FF7B3C65694
CloseHandle.KERNEL32 ref: 00007FF7B3C656C9

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: 605721e4370a51394ba8c74b10d39ef6eb861dedbc28f6000292dbef848f3043
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: A141B432D1878183E790ABA49518369B360FBA6364F609334EB9C53AD9DF7CE4E08710

Function 00007FF7B3C5CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B3C5CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7B3C5CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7B3C5CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF7B3C5CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7B3C5CD21

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: eb6a110a8f99e54fd3fd77bac3f367e303f863454e7ce981f5336428f1ddceaf
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: B7313D21E0824641FAD4BBED941E3B9A2919F63744FC69036DB4DA72DFDE2DA4848321

Function 00007FF7B3C69A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7B3C69A2C), ref: 00007FF7B3C69A41
TerminateProcess.KERNEL32(?,?,?,00007FF7B3C69A2C), ref: 00007FF7B3C69A4C
ExitProcess.KERNEL32 ref: 00007FF7B3C69A5B

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction ID: d0f79cd4eb81018869e1c588669180e637522375cd7d2a54ad681286781f8bb3
Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction Fuzzy Hash: 03D09E10B0870683EB943BF95D5D0B892956F6A712F941438CE0B673DBDD2DA8CA4320

Function 00007FF7B3C6013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C60180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C60277

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 01370cde678f49017d71bb41bd3cba8acc18867687378564ac17eb8ee7a617f0
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 64511F21B0D25186E7E4B9AD9408679E290BF96BA4F844634DF6DB37CDCE3CE4818620

Function 00007FF8A82B1DF7 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8A830F1BC
SetLastError.KERNEL32 ref: 00007FF8A830F1C3
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FF8A830F4B3

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: 9e1f5a9259e0aa48b60180f011c1c6fd63c9391dcfad61ef29b2cdf2ae2c5ec5
Instruction ID: b081ed33c1f8131219a90c4dbcd45d6a7eef5e9256f9f2465f45f17f59976125
Opcode Fuzzy Hash: 9e1f5a9259e0aa48b60180f011c1c6fd63c9391dcfad61ef29b2cdf2ae2c5ec5
Instruction Fuzzy Hash: 5B218132E0BA42A9FB68EAA5A84127D22B4FF41BD4F2C4430D94D466D5DF3CE8418679

Function 00007FF7B3C6C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF7B3C6C2CD), ref: 00007FF7B3C6C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF7B3C6C2CD), ref: 00007FF7B3C6C18A

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 6781698d2b3ac69246787e2fb3855e6aef61dcf86623f06367dbc812ea8af9d7
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 2C110462608A8181DAA0AB69A808069E361BB52FF0F944331EF7D5B7DDCE3CD0908710

Function 00007FF7B3C6AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF7B3C6A9D5,?,?,00000000,00007FF7B3C6AA8A), ref: 00007FF7B3C6ABC6
GetLastError.KERNEL32(?,?,?,00007FF7B3C6A9D5,?,?,00000000,00007FF7B3C6AA8A), ref: 00007FF7B3C6ABD0

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: fe07d9802532cfbe84222394dbd4e72331475d0ef40eccb322befa031355e7b2
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: D421F665B1868241FAD077DD944C37DA2829FE6790F880239EB6EA77CDCE6CE4C04324

Function 00007FF7B3C6BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C6BED4

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: 055fb7be67481d329dbef33404f301a441ee933c1fe590887e033a0cd7753d55
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 7341DB3690824187EAB4ABDEA95817DF3A4EB67740F501131D78ED36D9CF2CE482CB61

Function 00007FF7B3C57F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7B3C5803A

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 4900000118834b7d6e4087b4962dc8428ce36fa7a7de64a54251ee196edfec95
Instruction ID: 91436b8bfb1fbf2007c76b712cc2982a6bd49a9f103c15c29dd35885c8e4edec
Opcode Fuzzy Hash: 4900000118834b7d6e4087b4962dc8428ce36fa7a7de64a54251ee196edfec95
Instruction Fuzzy Hash: 2D219322B1875146EA90BAA668093BAD641BF96BC4FC94431EF0C677CADE7DF081C214

Function 00007FF7B3C6B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C6B9C2

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: 345964ea2db7c2d1006883b1a2b81bce0665b92a48e57a0c4cc9048859a6f84f
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: 4F31A622A1860185E7917FDE884837CBA60AF62B55FC10135DB5DA33DADE7CA4C18731

Function 00007FF7B3C69961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7B3C6998F

Part of subcall function 00007FF7B3C69A88: GetModuleHandleExW.KERNEL32 ref: 00007FF7B3C69AAD
Part of subcall function 00007FF7B3C69A88: GetProcAddress.KERNEL32 ref: 00007FF7B3C69AC3
Part of subcall function 00007FF7B3C69A88: FreeLibrary.KERNEL32 ref: 00007FF7B3C69AEA

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction ID: 18d696cbc71346108f26161e9b7fe7f90686043918af899e7fe65ea1c6d06843
Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction Fuzzy Hash: FB21D172A04B4589EBA0AFA8C4882EC33E0FB55318F840636D75CA7AD9DF38D484C750

Function 00007FF7B3C65F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C65EF9

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: d8b6e95b004fb0f5113f5544b9ffe88cd92f4efcb7c632f550191c8d9988ac72
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 58118731A1C64242EAE0BF99941417DE664BFA6B84FD44431EB4CE7ADDCF3DD8814721

Function 00007FF7B3C76354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C76377

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: cafa9eeb03756c451531e00522bca4d58f673354426603ab5a92bcd5a734cf9a
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: F8212532608A41C6DBA0AF5CD444379B2A0FB95B51F940234EB5D876DDDF3CD450CB10

Function 00007FF7B3C603BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C60410

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: c658ecebf09fd5b3b3c22eb1a7052dc3a1965412b4867707928a2113450e837f
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 2701E92160875141E594EF9A5904079E690BFA7FE0F884530DF5CB37DECE3CD4818310

Function 00007FF7B3C58E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B3C59390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7B3C545F4,00000000,00007FF7B3C51985), ref: 00007FF7B3C593C9

LoadLibraryExW.KERNEL32(?,00007FF7B3C56476,?,00007FF7B3C5336E), ref: 00007FF7B3C58EA2

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction ID: 5825d9602afe837559a35d2ec2d3f1711b42ee1d9d0df826e0f1fa11ba136bf2
Opcode Fuzzy Hash: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction Fuzzy Hash: C7D0CD01F3414541EA84B7AB794A63591516F9ABC0FC8C035FF0D0378DDC3CC0814700

Function 00007FF7B3C6D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7B3C60C90,?,?,?,00007FF7B3C622FA,?,?,?,?,?,00007FF7B3C63AE9), ref: 00007FF7B3C6D63A

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: afd5f52f29c27f8e6bfd994a950c69a764f9d23d27579b19b10e960045c3e997
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: F7F05420F0820240FED537F9580D27491504FA67A1F884B30DF2EE72CADD1CE4C49130

Non-executed Functions

Function 00007FF7B3C589E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B3C59390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7B3C545F4,00000000,00007FF7B3C51985), ref: 00007FF7B3C593C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58A56

Part of subcall function 00007FF7B3C6A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C6A490

Part of subcall function 00007FF7B3C6871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C68783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58AE6
CreateProcessW.KERNEL32 ref: 00007FF7B3C58B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58B28

Part of subcall function 00007FF7B3C52C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B3C53706,?,00007FF7B3C53804), ref: 00007FF7B3C52C9E
Part of subcall function 00007FF7B3C52C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B3C53706,?,00007FF7B3C53804), ref: 00007FF7B3C52D63
Part of subcall function 00007FF7B3C52C50: MessageBoxW.USER32 ref: 00007FF7B3C52D99

RegisterClassW.USER32 ref: 00007FF7B3C58B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58B8B
CreateWindowExW.USER32 ref: 00007FF7B3C58BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58C15
PeekMessageW.USER32 ref: 00007FF7B3C58C39
TranslateMessage.USER32 ref: 00007FF7B3C58C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58C51
PeekMessageW.USER32 ref: 00007FF7B3C58C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58E04
GetExitCodeProcess.KERNEL32 ref: 00007FF7B3C58E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7B3C53F77), ref: 00007FF7B3C58E2F

Strings

PyInstallerOnefileHiddenWindow, xrefs: 00007FF7B3C58B54
Failed to create child process!, xrefs: 00007FF7B3C58B30
PyInstaller Onefile Hidden Window, xrefs: 00007FF7B3C58B95
CreateProcessW, xrefs: 00007FF7B3C58B37

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: c6fec44b3e06f5cb5d476b6d45460a211f2265847313120db2772df73325fd04
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 07D17531A08B8286E790AFB8D8592B9B760FF65759F800135DF5D636D8DF3CE1848710

Function 00007FF8A82B2185 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 178COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A8302A71
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8302A89
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8302ABE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8302AD6
EVP_PKEY_get1_encoded_public_key.LIBCRYPTO-3 ref: 00007FF8A8302B29
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8302B94
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8302BBB
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8302BDB
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8302BF0
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FF8A8302C15
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8302C2C
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8302C36
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8302C4E

Strings

add_key_share, xrefs: 00007FF8A8302AC3, 00007FF8A8302BE0
tls_construct_ctos_key_share, xrefs: 00007FF8A8302A76, 00007FF8A8302BC0, 00007FF8A8302C3B
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8A8302A82, 00007FF8A8302ACF, 00007FF8A8302B79, 00007FF8A8302BE9, 00007FF8A8302C1F, 00007FF8A8302C47

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_new$R_set_debug$O_free$Y_freeY_get1_encoded_public_key
String ID: ..\s\ssl\statem\extensions_clnt.c$add_key_share$tls_construct_ctos_key_share
API String ID: 2910640537-2776458525
Opcode ID: d0641521a8085f99a510304bc130ac0297c1851443fc4ba5da5bcaeed058df4f
Instruction ID: f5ca6c7a5ded6504679f4fb804d2ec01744deaddbd0ccc6b46675da1a8bf26fd
Opcode Fuzzy Hash: d0641521a8085f99a510304bc130ac0297c1851443fc4ba5da5bcaeed058df4f
Instruction Fuzzy Hash: 73718F11B1FE8265FB60AB62D5503BA52A1EF857C0F4C4031EE8D47B9ADF3CE5419728

Function 00007FF8A81F42B0 Relevance: 21.5, APIs: 2, Strings: 12, Instructions: 452COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF8A81F4732
memcpy.VCRUNTIME140 ref: 00007FF8A81F4834

Strings

mode, xrefs: 00007FF8A81F460E
cach, xrefs: 00007FF8A81F47B0
cach, xrefs: 00007FF8A81F461F
access, xrefs: 00007FF8A81F46F5
mode, xrefs: 00007FF8A81F4791
localhos, xrefs: 00007FF8A81F440E
no such %s mode: %s, xrefs: 00007FF8A81F475E
%s mode not allowed: %s, xrefs: 00007FF8A81F47EE
cache, xrefs: 00007FF8A81F46CB
invalid uri authority: %.*s, xrefs: 00007FF8A81F4437
file, xrefs: 00007FF8A81F432B
no such vfs: %s, xrefs: 00007FF8A81F48E4

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcmpmemcpy
String ID: %s mode not allowed: %s$access$cach$cach$cache$file$invalid uri authority: %.*s$localhos$mode$mode$no such %s mode: %s$no such vfs: %s
API String ID: 1784268899-1067337024
Opcode ID: 5f15b9148e8d691bade7ac4299c338194b5adc1f0a67d16e58ed18eaea73a7c4
Instruction ID: 45abdf4d6a98b837801c5e10daa22e9df2e3a100008c48a1e0fd826a875d4468
Opcode Fuzzy Hash: 5f15b9148e8d691bade7ac4299c338194b5adc1f0a67d16e58ed18eaea73a7c4
Instruction Fuzzy Hash: 0A021662F0E68265FB668B1494103792A91FB52BE4F04C237CA5E436D5DFBDEC41C728

Function 00007FF8A8011880 Relevance: 13.9, APIs: 9, Instructions: 425COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON312 ref: 00007FF8A80118E3
PyType_IsSubtype.PYTHON312 ref: 00007FF8A80119D6
PyType_IsSubtype.PYTHON312 ref: 00007FF8A8011A33
PyUnicode_FromKindAndData.PYTHON312 ref: 00007FF8A8011B04
PyMem_Free.PYTHON312 ref: 00007FF8A8011B12
PyMem_Realloc.PYTHON312 ref: 00007FF8A8011BF8
PyMem_Free.PYTHON312 ref: 00007FF8A8013B1A
PyErr_NoMemory.PYTHON312 ref: 00007FF8A8013B20

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Mem_$FreeSubtypeType_$DataErr_FromKindMallocMemoryReallocUnicode_
String ID:
API String ID: 3719493655-0
Opcode ID: 0b61fa8abd9dfcdf7751d429d18c280f61a1d7a5a4373fae919a70ebd3257318
Instruction ID: e579a16af530711f573cff4d44494838c5d75eb7b89d04f301dbb528ea953a41
Opcode Fuzzy Hash: 0b61fa8abd9dfcdf7751d429d18c280f61a1d7a5a4373fae919a70ebd3257318
Instruction Fuzzy Hash: 6D021472B0E692E2EF288B14D44467967A1FB547E0F595131E68E877C4EF3CE420C328

Function 00007FF8A8013028 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8A8013044
memset.VCRUNTIME140 ref: 00007FF8A8013068
RtlCaptureContext.KERNEL32 ref: 00007FF8A8013071
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8A801308B
RtlVirtualUnwind.KERNEL32 ref: 00007FF8A80130CC
memset.VCRUNTIME140 ref: 00007FF8A80130FF
IsDebuggerPresent.KERNEL32 ref: 00007FF8A8013120
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8A801313D
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8A8013148

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 077b0f214cb87451efc13930c849abf149ec882450af492fe5d50a1ac414abff
Instruction ID: a000fcae23fdf5dfa3845d274cf372c7d6b10bc7b7e24f79a0e9f2fd45c2b303
Opcode Fuzzy Hash: 077b0f214cb87451efc13930c849abf149ec882450af492fe5d50a1ac414abff
Instruction Fuzzy Hash: D8312D7260AB81DAEF618FA0E8503E973A4FB84794F44403ADA4D47B95DF3CD658C724

Function 00007FF8A81ACF30 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 441COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A81AD5A7

Strings

invalid, xrefs: 00007FF8A81ACF72
unopened, xrefs: 00007FF8A81ACF7D
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A81ACF95
misuse, xrefs: 00007FF8A81ACFA2
%s at line %d of [%.10s], xrefs: 00007FF8A81ACFAE
NULL, xrefs: 00007FF8A81ACF5D
API call with %s database connection pointer, xrefs: 00007FF8A81ACF84

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API call with %s database connection pointer$NULL$invalid$misuse$unopened
API String ID: 3510742995-509082904
Opcode ID: 56816c8325c5220a8072bec6d2959b7a25c125183c295eb9729de22f243e3fcb
Instruction ID: 13a73e35c0ecc541b270f150c27db46de5a29758b5762e172c5cafdf0ce0f658
Opcode Fuzzy Hash: 56816c8325c5220a8072bec6d2959b7a25c125183c295eb9729de22f243e3fcb
Instruction Fuzzy Hash: 6B129F61A0BE42A5EB669F21E4503B9ABA1FF44BC8F544832DE4E07794DF3DE445C328

Function 00007FF8A813FA10 Relevance: 12.4, APIs: 2, Strings: 6, Instructions: 404COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A813FA50
memset.VCRUNTIME140 ref: 00007FF8A813FADF

Strings

winGetTempname5, xrefs: 00007FF8A813FCAA
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789, xrefs: 00007FF8A813FD00
etilqs_, xrefs: 00007FF8A813FCB8
winGetTempname1, xrefs: 00007FF8A813FBDF
winGetTempname4, xrefs: 00007FF8A813FFAA
winGetTempname2, xrefs: 00007FF8A813FB12

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memset
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789$etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 2221118986-463513059
Opcode ID: 78c9b8753e755e59b52ad9df02d031d17bd590a1a55ad9eefdba0f6dc705e711
Instruction ID: c61f155e4e3e5e88a2b273c7f38eebfdcb2265108cca00fce3016a637786164a
Opcode Fuzzy Hash: 78c9b8753e755e59b52ad9df02d031d17bd590a1a55ad9eefdba0f6dc705e711
Instruction Fuzzy Hash: 12E13252B0E7C627EA4E8B3929251786B91EB457C0F548136DEAE437C1EF3CF516C228

Function 00007FF8A815E5C0 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 402COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A815E6E2

Strings

Failed to read ptrmap key=%u, xrefs: 00007FF8A815E898
Bad ptr map entry key=%u expected=(%u,%u) got=(%u,%u), xrefs: 00007FF8A815E8C0
incremental_vacuum enabled with a max rootpage of zero, xrefs: 00007FF8A815E7EF
Page %u: never used, xrefs: 00007FF8A815E9B5
max rootpage (%u) disagrees with header (%u), xrefs: 00007FF8A815E7CB
Freelist: , xrefs: 00007FF8A815E753
Page %u: pointer map referenced, xrefs: 00007FF8A815EA1F

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memset
String ID: Bad ptr map entry key=%u expected=(%u,%u) got=(%u,%u)$Failed to read ptrmap key=%u$Freelist: $Page %u: never used$Page %u: pointer map referenced$incremental_vacuum enabled with a max rootpage of zero$max rootpage (%u) disagrees with header (%u)
API String ID: 2221118986-741541785
Opcode ID: 03aa636d779c79df6cfcf3b98acaf76e22c4f5431ab87a659340e15e6eb3a17c
Instruction ID: eafab5adfbb42b5f48a11c4f7d56b4beb11bdab5e8840d57d8365d1b6ec20d8b
Opcode Fuzzy Hash: 03aa636d779c79df6cfcf3b98acaf76e22c4f5431ab87a659340e15e6eb3a17c
Instruction Fuzzy Hash: 69029F72F0A6429AEB29DF65E4406BD77A1FB84784F10213ADA4E47B98DF3CE441CB14

Function 00007FF7B3C583C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF7B3C58919,00007FF7B3C53F9D), ref: 00007FF7B3C5842B
RemoveDirectoryW.KERNEL32(?,00007FF7B3C58919,00007FF7B3C53F9D), ref: 00007FF7B3C584AE
DeleteFileW.KERNEL32(?,00007FF7B3C58919,00007FF7B3C53F9D), ref: 00007FF7B3C584CD
FindNextFileW.KERNEL32(?,00007FF7B3C58919,00007FF7B3C53F9D), ref: 00007FF7B3C584DB
FindClose.KERNEL32(?,00007FF7B3C58919,00007FF7B3C53F9D), ref: 00007FF7B3C584EC
RemoveDirectoryW.KERNEL32(?,00007FF7B3C58919,00007FF7B3C53F9D), ref: 00007FF7B3C584F5

Strings

%s\*, xrefs: 00007FF7B3C583F2

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: 4f0a9286a96693abb54686e0430dab70ec85aa819ea45a6b9c380770ce0c97fc
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: 2C418621B0D642C1EAA0BB98E45D1BAA360FB66755FC10232DB5E636DCDF3CE585C710

Function 00007FF8A80112F0 Relevance: 10.8, APIs: 7, Instructions: 343COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8011880: PyMem_Malloc.PYTHON312 ref: 00007FF8A80118E3
Part of subcall function 00007FF8A8011880: PyType_IsSubtype.PYTHON312 ref: 00007FF8A80119D6
Part of subcall function 00007FF8A8011880: PyType_IsSubtype.PYTHON312 ref: 00007FF8A8011A33

PyMem_Malloc.PYTHON312 ref: 00007FF8A8011376
PyMem_Free.PYTHON312 ref: 00007FF8A801147C
PyErr_NoMemory.PYTHON312 ref: 00007FF8A8013989
_Py_Dealloc.PYTHON312 ref: 00007FF8A801399D

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
String ID:
API String ID: 4139299733-0
Opcode ID: 1a81e9c38499873679165206c29f2f174bec07526da98c475f808ef3ba3417ca
Instruction ID: afed291bebdfd92852cbd49d03d20a6ede5687dbdb9752c108a056892acbecd3
Opcode Fuzzy Hash: 1a81e9c38499873679165206c29f2f174bec07526da98c475f808ef3ba3417ca
Instruction Fuzzy Hash: C0E1CE72E0E652E1EF298B15904467D63A5FB60BE4F151131DA8F876D4EF3CE861C328

Function 00007FF7B3C5D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7B3C5D148
RtlCaptureContext.KERNEL32 ref: 00007FF7B3C5D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7B3C5D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7B3C5D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF7B3C5D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7B3C5D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7B3C5D24C

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: 6d06b7ed7ca304e1a0d0994e705391fd23b2359226af580637bbbdf377994822
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 1C314172609B81C6EBA09FA4E8483EEB360FB95705F44403ADB4E57B99DF38D588C710

Function 00007FF8A82C4990 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

i2d_X509_NAME.LIBCRYPTO-3 ref: 00007FF8A82C49B7
i2d_X509_NAME.LIBCRYPTO-3 ref: 00007FF8A82C49C7
memcmp.VCRUNTIME140 ref: 00007FF8A82C49EC
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82C4A0A
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82C4A21

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FF8A82C4A00, 00007FF8A82C4A14

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: O_freeX509_i2d_$memcmp
String ID: ..\s\ssl\ssl_cert.c
API String ID: 1487052844-349359282
Opcode ID: 777fb18747a5d81ff922ad4c58779e9ac14b1738b0b77e584ed02f53f2ca7fed
Instruction ID: a69cb7def88bd1b46559d781ea5f620b14dd8036d87245ef0aca4b39baaf53c5
Opcode Fuzzy Hash: 777fb18747a5d81ff922ad4c58779e9ac14b1738b0b77e584ed02f53f2ca7fed
Instruction Fuzzy Hash: E301C462B0EB4261EB50AA19F44017A5772EB8A7D0F685131EB8D47B8EEF3ED5404724

Function 00007FF8A81B4C70 Relevance: 9.4, APIs: 3, Strings: 3, Instructions: 370COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A81B4CDF
memcpy.VCRUNTIME140 ref: 00007FF8A81B4EFD
memcpy.VCRUNTIME140 ref: 00007FF8A81B4FAE

Strings

out of memory, xrefs: 00007FF8A81B4D5F
statement too long, xrefs: 00007FF8A81B4EB3
database schema is locked: %s, xrefs: 00007FF8A81B4E56

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy$memset
String ID: database schema is locked: %s$out of memory$statement too long
API String ID: 438689982-1046679716
Opcode ID: 5d5be185957a176ff2293f08ac2306814a76a282c54904e86601318931ffcb8f
Instruction ID: 7b13b252297659e874f41c0c164eb8396e342ef4ef9309781e37e1faa58285d8
Opcode Fuzzy Hash: 5d5be185957a176ff2293f08ac2306814a76a282c54904e86601318931ffcb8f
Instruction Fuzzy Hash: B4F1A622A0A7C1AAEB66CF25D4087BA6794FB857C8F084135DA4D07795DF7CE880C754

Function 00007FF7B3C75C00 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7B3C75C45

Part of subcall function 00007FF7B3C75598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C755AC

Part of subcall function 00007FF7B3C6A948: HeapFree.KERNEL32(?,?,?,00007FF7B3C72D22,?,?,?,00007FF7B3C72D5F,?,?,00000000,00007FF7B3C73225,?,?,?,00007FF7B3C73157), ref: 00007FF7B3C6A95E
Part of subcall function 00007FF7B3C6A948: GetLastError.KERNEL32(?,?,?,00007FF7B3C72D22,?,?,?,00007FF7B3C72D5F,?,?,00000000,00007FF7B3C73225,?,?,?,00007FF7B3C73157), ref: 00007FF7B3C6A968

Part of subcall function 00007FF7B3C6A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7B3C6A8DF,?,?,?,?,?,00007FF7B3C6A7CA), ref: 00007FF7B3C6A909
Part of subcall function 00007FF7B3C6A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7B3C6A8DF,?,?,?,?,?,00007FF7B3C6A7CA), ref: 00007FF7B3C6A92E

_get_daylight.LIBCMT ref: 00007FF7B3C75C34

Part of subcall function 00007FF7B3C755F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C7560C

_get_daylight.LIBCMT ref: 00007FF7B3C75EAA
_get_daylight.LIBCMT ref: 00007FF7B3C75EBB
_get_daylight.LIBCMT ref: 00007FF7B3C75ECC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7B3C7610C), ref: 00007FF7B3C75EF3

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction ID: a0b87f4e277a0dc3ba0e17cf905754e48446f75c78ff0443d4b81e1ab99e36ba
Opcode Fuzzy Hash: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction Fuzzy Hash: 16D10526A0824285E7A0BFA9C4491B9A751FFA6785FC48135DF1D676CDDF3CE8C18360

Function 00007FF8A8137336 Relevance: 9.3, APIs: 2, Strings: 4, Instructions: 332COMMON

Download Yara Rule

Strings

0123456789ABCDEF0123456789abcdef, xrefs: 00007FF8A8137529
VUUU, xrefs: 00007FF8A813759B
-x0, xrefs: 00007FF8A8137606
VUUU, xrefs: 00007FF8A813746E

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID: -x0$0123456789ABCDEF0123456789abcdef$VUUU$VUUU
API String ID: 0-2031831958
Opcode ID: 27ee5c829f6d79043f4cbad637b212a471c0560ebe4aff584a080aef168f4e0b
Instruction ID: 21f365f9452f86c6a43e7c46360b31e472b516638eb7905ce13347bb05fc876b
Opcode Fuzzy Hash: 27ee5c829f6d79043f4cbad637b212a471c0560ebe4aff584a080aef168f4e0b
Instruction Fuzzy Hash: 16D12362B1E68296EBA68B29D094B797BE5FB847C0F4A4434DE4E43785DF2CE440C724

Function 00007FF7B3C6A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7B3C6A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7B3C6A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7B3C6A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF7B3C6A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7B3C6A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7B3C6A72E

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: 91c17327ccabd2f6ad10895b6dc70e0e720b700ef9258c9cec37bd3cf8ee2ef7
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 02319236608B8185DBA0DF69E8482AEB3A0FB95758F900135EB9D53B99DF3CD185CB10

Function 00007FF8A82B114F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82F4B11
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82F4BFF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82F4C17

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FF8A82F4B04, 00007FF8A82F4C10
dtls1_process_buffered_records, xrefs: 00007FF8A82F4C04

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: O_freeR_newR_set_debug
String ID: ..\s\ssl\record\rec_layer_d1.c$dtls1_process_buffered_records
API String ID: 2314896662-3750322838
Opcode ID: 9b7d533bb197c52e98715f895ff29401a5e6b6861563f37595cca6a8ec151ea3
Instruction ID: c834570ac7da02785e0fd45e0ea88a92881db4c954d3358aeafe880bffc39541
Opcode Fuzzy Hash: 9b7d533bb197c52e98715f895ff29401a5e6b6861563f37595cca6a8ec151ea3
Instruction Fuzzy Hash: 57418161B0A642A4FB109F12D5502B96361FF94BC4F588132DE4D4769EEFACE861C368

Function 00007FF7B3C71874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C718C0
FindFirstFileExW.KERNEL32 ref: 00007FF7B3C719CA

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction ID: d978a5958470bfa1d265520686d6d6ca4a802294de81c4ac92f9c111783c42cb
Opcode Fuzzy Hash: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction Fuzzy Hash: B5B1ED62B1868281EAA0BFA995081B9E350EF66BE5F846131DF5D67BCDDF3CD481C310

Function 00007FF8A8158020 Relevance: 6.6, APIs: 5, Instructions: 362COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A81581B9
memset.VCRUNTIME140 ref: 00007FF8A81581CA
memcpy.VCRUNTIME140 ref: 00007FF8A8158248
memcpy.VCRUNTIME140 ref: 00007FF8A8158260
memset.VCRUNTIME140 ref: 00007FF8A815826F

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: dba73455f6f234f8bbefecc76f180073ee716590355594a84bd531c554655bcd
Instruction ID: 205cd1a84cb236294b73e9a6614db144514375f820c99098feaba8d8c0bed3a9
Opcode Fuzzy Hash: dba73455f6f234f8bbefecc76f180073ee716590355594a84bd531c554655bcd
Instruction Fuzzy Hash: 3BE1FF3261A7819AE7958F25D0807BE67A1FB48BC4F04A036EE4E47785DF3DE455C314

Function 00007FF7B3C75E7C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7B3C75EAA

Part of subcall function 00007FF7B3C755F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C7560C

_get_daylight.LIBCMT ref: 00007FF7B3C75EBB

Part of subcall function 00007FF7B3C75598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C755AC

_get_daylight.LIBCMT ref: 00007FF7B3C75ECC

Part of subcall function 00007FF7B3C755C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C755DC

Part of subcall function 00007FF7B3C6A948: HeapFree.KERNEL32(?,?,?,00007FF7B3C72D22,?,?,?,00007FF7B3C72D5F,?,?,00000000,00007FF7B3C73225,?,?,?,00007FF7B3C73157), ref: 00007FF7B3C6A95E
Part of subcall function 00007FF7B3C6A948: GetLastError.KERNEL32(?,?,?,00007FF7B3C72D22,?,?,?,00007FF7B3C72D5F,?,?,00000000,00007FF7B3C73225,?,?,?,00007FF7B3C73157), ref: 00007FF7B3C6A968

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7B3C7610C), ref: 00007FF7B3C75EF3

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction ID: 185976b2be32510bde824ed1534ab51c5e70c68571550b6affde701e9b5be298
Opcode Fuzzy Hash: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction Fuzzy Hash: 2051D731A0864286E790FFA9D889179E750FBAA784FC04135DF1D676D9DF3CE4818760

Function 00007FF8A83089F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8308A27
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FF8A8308A50

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FF8A8308A17, 00007FF8A8308A40

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: O_freeO_memdup
String ID: D:\a\1\s\include\internal/packet.h
API String ID: 3962629258-2521442236
Opcode ID: b37658dcad52b1436dcc0843c4ff8bfc36452bfe40221a3fec933389c799bde5
Instruction ID: 1e71d15cbf1e07e4ff228946e78ef52d764b7e802391bad48e9b1504907fec61
Opcode Fuzzy Hash: b37658dcad52b1436dcc0843c4ff8bfc36452bfe40221a3fec933389c799bde5
Instruction Fuzzy Hash: 4C012C32B1BF8291EB509F02E8806A96764EB58BC0F088431EF8D87B49EF3CD5618714

Function 00007FF8A82F8D40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FF8A82F8D69
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82F8D82

Strings

..\s\ssl\record\ssl3_buffer.c, xrefs: 00007FF8A82F8D75

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: L_cleanseO_free
String ID: ..\s\ssl\record\ssl3_buffer.c
API String ID: 4015144264-837614940
Opcode ID: b409ca71e0b3d08068fbb85c1c828ecdf3a3d194a80410a3f75eb563c85d813a
Instruction ID: 46fe625d5b2f8756ca166eafaf630e8acc206e7d152af866410b47069e39f716
Opcode Fuzzy Hash: b409ca71e0b3d08068fbb85c1c828ecdf3a3d194a80410a3f75eb563c85d813a
Instruction Fuzzy Hash: E0F08261A07E8584F7909B29D4857E82690EB04B84F580230DE4C8B386EF29C596C324

Function 00007FF8A82C4930 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

CRYPTO_get_ex_new_index.LIBCRYPTO-3 ref: 00007FF8A82C495A

Strings

SSL for verify callback, xrefs: 00007FF8A82C493F

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: O_get_ex_new_index
String ID: SSL for verify callback
API String ID: 3987194240-2900698531
Opcode ID: 998d0b3d89f92af84c439d3d6d1f282b82ea7a3ae54b8f9e838ebb840228e167
Instruction ID: 440d75f1eb06749d5bff701e7aa9cb8f9e3e0839a99deebf755749dcb3b2861a
Opcode Fuzzy Hash: 998d0b3d89f92af84c439d3d6d1f282b82ea7a3ae54b8f9e838ebb840228e167
Instruction Fuzzy Hash: 0DE04875E0AE4296E3109768A8016A677E1FB84380F444535E6CCC3751EF3C91118B14

Function 00007FF8A82FE920 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82FE946

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FF8A82FE932

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions.c
API String ID: 2581946324-1165805907
Opcode ID: a61c9ce346b74f3a0deff5805a9348d450189386ed9d9072d823e30e35c2c8a0
Instruction ID: 871c1255813affcdcbf71d1f472692139e2782cf87d2b5168360956f03b48d99
Opcode Fuzzy Hash: a61c9ce346b74f3a0deff5805a9348d450189386ed9d9072d823e30e35c2c8a0
Instruction Fuzzy Hash: E2E012A2B07A409EEB455765D8053E42294FB08784F880030EE9CC7785FF68C6518324

Function 00007FF7B3C55830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C55840
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C55852
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C55889
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C5589B
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C558B4
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C558C6
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C558DF
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C558F1
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C5590D
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C5591F
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C5593B
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C5594D
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C55969
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C5597B
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C55997
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C559A9
GetProcAddress.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C559C5
GetLastError.KERNEL32(?,00007FF7B3C564CF,?,00007FF7B3C5336E), ref: 00007FF7B3C559D7

Strings

PyUnicode_Replace, xrefs: 00007FF7B3C55FD7, 00007FF7B3C55FF9
Py_Finalize, xrefs: 00007FF7B3C558D5, 00007FF7B3C558F7
PyMarshal_ReadObjectFromString, xrefs: 00007FF7B3C55C6D, 00007FF7B3C55C8F
PyConfig_SetWideStringList, xrefs: 00007FF7B3C55A73, 00007FF7B3C55A95
PyErr_NormalizeException, xrefs: 00007FF7B3C55AFD, 00007FF7B3C55B1F
PyErr_Fetch, xrefs: 00007FF7B3C55ACF, 00007FF7B3C55AF1
PyRun_SimpleStringFlags, xrefs: 00007FF7B3C55E0B, 00007FF7B3C55E2D
PyObject_CallFunctionObjArgs, xrefs: 00007FF7B3C55D25, 00007FF7B3C55D47
Failed to get address for %hs, xrefs: 00007FF7B3C55861
PyUnicode_Decode, xrefs: 00007FF7B3C55EF1, 00007FF7B3C55F13
PyConfig_SetString, xrefs: 00007FF7B3C55A45, 00007FF7B3C55A67
PyImport_AddModule, xrefs: 00007FF7B3C55BE3, 00007FF7B3C55C05
GetProcAddress, xrefs: 00007FF7B3C55868
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7B3C55DDD, 00007FF7B3C55DFF
PyObject_CallFunction, xrefs: 00007FF7B3C55CF7, 00007FF7B3C55D19
PyUnicode_FromFormat, xrefs: 00007FF7B3C55F4D, 00007FF7B3C55F6F
PySys_SetObject, xrefs: 00007FF7B3C55E95, 00007FF7B3C55EB7
PyObject_SetAttrString, xrefs: 00007FF7B3C55D81, 00007FF7B3C55DA3
PyConfig_Clear, xrefs: 00007FF7B3C5598D, 00007FF7B3C559AF
PyObject_GetAttrString, xrefs: 00007FF7B3C55D53, 00007FF7B3C55D75
PyUnicode_Join, xrefs: 00007FF7B3C55FA9, 00007FF7B3C55FCB
PyErr_Clear, xrefs: 00007FF7B3C55AA1, 00007FF7B3C55AC3
Py_ExitStatusException, xrefs: 00007FF7B3C558AA, 00007FF7B3C558CC
PyObject_Str, xrefs: 00007FF7B3C55DAF, 00007FF7B3C55DD1
PyImport_ExecCodeModule, xrefs: 00007FF7B3C55C11, 00007FF7B3C55C33
PySys_GetObject, xrefs: 00007FF7B3C55E67, 00007FF7B3C55E89
PyImport_ImportModule, xrefs: 00007FF7B3C55C3F, 00007FF7B3C55C61
PyUnicode_AsUTF8, xrefs: 00007FF7B3C55EC3, 00007FF7B3C55EE5
PyConfig_SetBytesString, xrefs: 00007FF7B3C55A17, 00007FF7B3C55A39
PyErr_Occurred, xrefs: 00007FF7B3C55B2B, 00007FF7B3C55B4D
Py_InitializeFromConfig, xrefs: 00007FF7B3C55903, 00007FF7B3C55925
PyUnicode_DecodeFSDefault, xrefs: 00007FF7B3C55F1F, 00007FF7B3C55F41
Py_PreInitialize, xrefs: 00007FF7B3C5595F, 00007FF7B3C55981
PyStatus_Exception, xrefs: 00007FF7B3C55E39, 00007FF7B3C55E5B
PyConfig_Read, xrefs: 00007FF7B3C559E9, 00007FF7B3C55A0B
PyErr_Print, xrefs: 00007FF7B3C55B59, 00007FF7B3C55B7B
Py_DecRef, xrefs: 00007FF7B3C55836, 00007FF7B3C55858
PyConfig_InitIsolatedConfig, xrefs: 00007FF7B3C559BB, 00007FF7B3C559DD
Py_IsInitialized, xrefs: 00007FF7B3C55931, 00007FF7B3C55953
PyErr_Restore, xrefs: 00007FF7B3C55B87, 00007FF7B3C55BA9
PyModule_GetDict, xrefs: 00007FF7B3C55CC9, 00007FF7B3C55CEB
PyMem_RawFree, xrefs: 00007FF7B3C55C9B, 00007FF7B3C55CBD
PyUnicode_FromString, xrefs: 00007FF7B3C55F7B, 00007FF7B3C55F9D
PyEval_EvalCode, xrefs: 00007FF7B3C55BB5, 00007FF7B3C55BD7
Py_DecodeLocale, xrefs: 00007FF7B3C5587F, 00007FF7B3C558A1

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 21f5facf22384e5425ab7cb47c3415d5fc7c56c11a7207b93fd420eb32fc09e3
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: 2222DC6194DB07D1FAC5BBDDA81D178A2A0BF26756FC55036CA1E212DDFF3CA5C88220

Function 00007FF7B3C576C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7B3C576D7
GetLastError.KERNEL32 ref: 00007FF7B3C576E9
GetProcAddress.KERNEL32 ref: 00007FF7B3C57725
GetLastError.KERNEL32 ref: 00007FF7B3C57737
GetProcAddress.KERNEL32 ref: 00007FF7B3C57750
GetLastError.KERNEL32 ref: 00007FF7B3C57762
GetProcAddress.KERNEL32 ref: 00007FF7B3C5777B
GetLastError.KERNEL32 ref: 00007FF7B3C5778D
GetProcAddress.KERNEL32 ref: 00007FF7B3C577A9
GetLastError.KERNEL32 ref: 00007FF7B3C577BB
GetProcAddress.KERNEL32 ref: 00007FF7B3C577D7
GetLastError.KERNEL32 ref: 00007FF7B3C577E9
GetProcAddress.KERNEL32 ref: 00007FF7B3C57805
GetLastError.KERNEL32 ref: 00007FF7B3C57817
GetProcAddress.KERNEL32 ref: 00007FF7B3C57833
GetLastError.KERNEL32 ref: 00007FF7B3C57845
GetProcAddress.KERNEL32 ref: 00007FF7B3C57861
GetLastError.KERNEL32 ref: 00007FF7B3C57873

Strings

Tcl_CreateThread, xrefs: 00007FF7B3C57829, 00007FF7B3C5784B
Tcl_GetVar2, xrefs: 00007FF7B3C57A23, 00007FF7B3C57A45
Tcl_SetVar2, xrefs: 00007FF7B3C57A51, 00007FF7B3C57A73
Tcl_CreateInterp, xrefs: 00007FF7B3C5771B, 00007FF7B3C5773D
Tcl_MutexUnlock, xrefs: 00007FF7B3C578E1, 00007FF7B3C57903
Tcl_EvalFile, xrefs: 00007FF7B3C57B93, 00007FF7B3C57BB5
Tcl_NewStringObj, xrefs: 00007FF7B3C57ADB, 00007FF7B3C57AFD
Tcl_MutexFinalize, xrefs: 00007FF7B3C5790F, 00007FF7B3C57931
Failed to get address for %hs, xrefs: 00007FF7B3C576F8
Tcl_Finalize, xrefs: 00007FF7B3C5779F, 00007FF7B3C577C1
Tcl_EvalObjv, xrefs: 00007FF7B3C57BEF, 00007FF7B3C57C11
Tcl_Alloc, xrefs: 00007FF7B3C57C1D, 00007FF7B3C57C3F
GetProcAddress, xrefs: 00007FF7B3C576FF
Tk_Init, xrefs: 00007FF7B3C57C79, 00007FF7B3C57C9B
Tcl_DoOneEvent, xrefs: 00007FF7B3C57771, 00007FF7B3C57793
Tcl_SetVar2Ex, xrefs: 00007FF7B3C57B37, 00007FF7B3C57B59
Tcl_NewByteArrayObj, xrefs: 00007FF7B3C57B09, 00007FF7B3C57B2B
Tcl_CreateObjCommand, xrefs: 00007FF7B3C57A7F, 00007FF7B3C57AA1
Tcl_EvalEx, xrefs: 00007FF7B3C57BC1, 00007FF7B3C57BE3
Tcl_FinalizeThread, xrefs: 00007FF7B3C577CD, 00007FF7B3C577EF
Tcl_MutexLock, xrefs: 00007FF7B3C578B3, 00007FF7B3C578D5
Tcl_GetObjResult, xrefs: 00007FF7B3C57B65, 00007FF7B3C57B87
Tcl_ConditionFinalize, xrefs: 00007FF7B3C5793D, 00007FF7B3C5795F
Tk_GetNumMainWindows, xrefs: 00007FF7B3C57CA7, 00007FF7B3C57CC9
Tcl_Free, xrefs: 00007FF7B3C57C4B, 00007FF7B3C57C6D
Tcl_DeleteInterp, xrefs: 00007FF7B3C577FB, 00007FF7B3C5781D
Tcl_FindExecutable, xrefs: 00007FF7B3C57746, 00007FF7B3C57768
Tcl_GetCurrentThread, xrefs: 00007FF7B3C57857, 00007FF7B3C57879
Tcl_JoinThread, xrefs: 00007FF7B3C57885, 00007FF7B3C578A7
Tcl_Init, xrefs: 00007FF7B3C576D0, 00007FF7B3C576EF
Tcl_ConditionNotify, xrefs: 00007FF7B3C5796B, 00007FF7B3C5798D
Tcl_ThreadAlert, xrefs: 00007FF7B3C579F5, 00007FF7B3C57A17
Tcl_ThreadQueueEvent, xrefs: 00007FF7B3C579C7, 00007FF7B3C579E9
Tcl_GetString, xrefs: 00007FF7B3C57AAD, 00007FF7B3C57ACF
Tcl_ConditionWait, xrefs: 00007FF7B3C57999, 00007FF7B3C579BB

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: 16d60a62a424ed4d60223bb5aed7ed264de957536f2bc9b751a18fdf8e258cb4
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: A402AB6490EB07C1EAC5BBDDA81D574A261AF26746FD51131DA1E322ECEF3CB5C98220

Function 00007FF8A82F0DB0 Relevance: 66.7, APIs: 28, Strings: 10, Instructions: 218COMMON

Download Yara Rule

APIs

EVP_KDF_fetch.LIBCRYPTO-3 ref: 00007FF8A82F0E2C
EVP_MD_get0_name.LIBCRYPTO-3 ref: 00007FF8A82F0E3F
EVP_KDF_CTX_new.LIBCRYPTO-3 ref: 00007FF8A82F0E4C
EVP_KDF_free.LIBCRYPTO-3 ref: 00007FF8A82F0E57
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82F0E6E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82F0E8F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82F0EB1
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A82F0EC3
EVP_KDF_CTX_free.LIBCRYPTO-3 ref: 00007FF8A82F0ECB
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF8A82F0EF8
EVP_KDF_CTX_free.LIBCRYPTO-3 ref: 00007FF8A82F0F07
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82F0F0C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82F0F2D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82F0F4F
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A82F0F61
OSSL_PARAM_construct_int.LIBCRYPTO-3 ref: 00007FF8A82F0F7C
OSSL_PARAM_construct_utf8_string.LIBCRYPTO-3 ref: 00007FF8A82F0FAF
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3 ref: 00007FF8A82F0FE1
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3 ref: 00007FF8A82F1018
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3 ref: 00007FF8A82F104A
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3 ref: 00007FF8A82F1083
OSSL_PARAM_construct_end.LIBCRYPTO-3 ref: 00007FF8A82F10AA
EVP_KDF_derive.LIBCRYPTO-3 ref: 00007FF8A82F10DB
EVP_KDF_CTX_free.LIBCRYPTO-3 ref: 00007FF8A82F10E5
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82F10EE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82F110F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82F113B
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A82F114D

Strings

digest, xrefs: 00007FF8A82F0F86
prefix, xrefs: 00007FF8A82F0FF3
tls13_hkdf_expand, xrefs: 00007FF8A82F0E7A, 00007FF8A82F0F18, 00007FF8A82F10FA
key, xrefs: 00007FF8A82F0FB9
TLS13-KDF, xrefs: 00007FF8A82F0DFE
data, xrefs: 00007FF8A82F1074
..\s\ssl\tls13_enc.c, xrefs: 00007FF8A82F0E81, 00007FF8A82F0F1F, 00007FF8A82F1101
mode, xrefs: 00007FF8A82F0F70
label, xrefs: 00007FF8A82F1022
tls13 , xrefs: 00007FF8A82F0FEC

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_set_debug$M_construct_octet_string$R_newR_set_errorX_free$D_get0_nameD_get_sizeF_deriveF_fetchF_freeM_construct_endM_construct_intM_construct_utf8_stringX_new
String ID: ..\s\ssl\tls13_enc.c$TLS13-KDF$data$digest$key$label$mode$prefix$tls13 $tls13_hkdf_expand
API String ID: 2131617303-57965188
Opcode ID: c6eaacc39ceac1cc9577e17c44c788a4bd0ce75b56956969c8126a179ca674ea
Instruction ID: c14a035af6949a94a2d87d30a2f328c9d23fec0ac0e1e89e8ce4b45dda10d08e
Opcode Fuzzy Hash: c6eaacc39ceac1cc9577e17c44c788a4bd0ce75b56956969c8126a179ca674ea
Instruction Fuzzy Hash: 29A1C022E0AF8AA5F711AF64D8512F96720EFA57C8F485131EE4D17A4AEF3CE181C714

Function 00007FF8A82F09B0 Relevance: 56.2, APIs: 21, Strings: 11, Instructions: 185COMMON

Download Yara Rule

APIs

EVP_MD_get0_name.LIBCRYPTO-3 ref: 00007FF8A82F0A08
EVP_KDF_fetch.LIBCRYPTO-3 ref: 00007FF8A82F0A28
EVP_KDF_CTX_new.LIBCRYPTO-3 ref: 00007FF8A82F0A33
EVP_KDF_free.LIBCRYPTO-3 ref: 00007FF8A82F0A3E
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82F0A48
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82F0A60
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF8A82F0A85
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82F0A8E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82F0AA6
EVP_KDF_CTX_free.LIBCRYPTO-3 ref: 00007FF8A82F0AC4

Strings

digest, xrefs: 00007FF8A82F0AEC
prefix, xrefs: 00007FF8A82F0BDA
tls13_generate_secret, xrefs: 00007FF8A82F0A4D, 00007FF8A82F0A93, 00007FF8A82F0C7D
salt, xrefs: 00007FF8A82F0B9D
key, xrefs: 00007FF8A82F0B54
TLS13-KDF, xrefs: 00007FF8A82F0A14
..\s\ssl\tls13_enc.c, xrefs: 00007FF8A82F0A59, 00007FF8A82F0A9F, 00007FF8A82F0C89
mode, xrefs: 00007FF8A82F0AD8
label, xrefs: 00007FF8A82F0BF8
tls13 , xrefs: 00007FF8A82F0BD3
derived, xrefs: 00007FF8A82F0BF1

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_newR_set_debug$D_get0_nameD_get_sizeF_fetchF_freeX_freeX_new
String ID: ..\s\ssl\tls13_enc.c$TLS13-KDF$derived$digest$key$label$mode$prefix$salt$tls13 $tls13_generate_secret
API String ID: 2603205826-1355147087
Opcode ID: 8d763159b971ece7f60506b29be84e16247facd842a8a046acd4d51518242364
Instruction ID: d92d5b16de7c5d6be6645e9bd3fc5cc9bce15190f28611a2107e4320d868112d
Opcode Fuzzy Hash: 8d763159b971ece7f60506b29be84e16247facd842a8a046acd4d51518242364
Instruction Fuzzy Hash: 1781BE52E0AF8AA1E711DF65D8112F96720FFA9BC4F489231EE8D13646EF2CE185C714

Function 00007FF8A8312DF0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,00007FF8A83195D8), ref: 00007FF8A8312E16
ERR_set_debug.LIBCRYPTO-3(?,00007FF8A83195D8), ref: 00007FF8A8312E2E
ERR_new.LIBCRYPTO-3(?,00007FF8A83195D8), ref: 00007FF8A8312E71
ERR_set_debug.LIBCRYPTO-3(?,00007FF8A83195D8), ref: 00007FF8A8312E89

Strings

set_client_ciphersuite, xrefs: 00007FF8A8312E1B, 00007FF8A8312E76, 00007FF8A8312ECD, 00007FF8A8312F42, 00007FF8A8313030, 00007FF8A8313075
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A8312E27, 00007FF8A8312E82, 00007FF8A8312ED9, 00007FF8A8312F4E, 00007FF8A831303C, 00007FF8A8313081

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$set_client_ciphersuite
API String ID: 193678381-554836899
Opcode ID: 76f6961c22b8d2b88b5cd7b2827a0fb858bf665db698d6861412482e4a137625
Instruction ID: 338f0939072c80e3a29be080f3bc78b71f4afd9aacd1b893bde3405ea1717f31
Opcode Fuzzy Hash: 76f6961c22b8d2b88b5cd7b2827a0fb858bf665db698d6861412482e4a137625
Instruction Fuzzy Hash: EC718F21B1BE8265FB80EB25E4547B92650EF84BC4F4C1031EE4D47BDADF2DE5818728

Function 00007FF7B3C581D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B3C59390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7B3C545F4,00000000,00007FF7B3C51985), ref: 00007FF7B3C593C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7B3C586B7,?,?,00000000,00007FF7B3C53CBB), ref: 00007FF7B3C5822C

Part of subcall function 00007FF7B3C52810: MessageBoxW.USER32 ref: 00007FF7B3C528EA

Strings

\, xrefs: 00007FF7B3C58261
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7B3C58203
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7B3C5829D
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7B3C582D9
CreateDirectory, xrefs: 00007FF7B3C5837C
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7B3C58373
%.*s, xrefs: 00007FF7B3C5830C
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7B3C58240

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction ID: 4473b7c34878b211602681b1c69480396758950116e7c9690320ca2bbe7d3b31
Opcode Fuzzy Hash: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction Fuzzy Hash: 5A518811B1964281E6D0BBACD85E2B9E250AF76780FC54432DB0E626DDEE2CF5848360

Function 00007FF7B3C51600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7B3C516DA
Failed to extract %s: failed to open target file!, xrefs: 00007FF7B3C5165C
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7B3C517CA
Failed to create symbolic link %s!, xrefs: 00007FF7B3C51622
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7B3C51742
fseek, xrefs: 00007FF7B3C516E1
fopen, xrefs: 00007FF7B3C51663
fwrite, xrefs: 00007FF7B3C517D1
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7B3C517DF
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7B3C516A2
fread, xrefs: 00007FF7B3C517E6
malloc, xrefs: 00007FF7B3C51749

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: d8e1660e306644a3059456114562463667108454f96654c664cb3035ad910b0d
Instruction ID: e65bec370956f9dc6a20cfc58d186693dd383df30c622eccd5a3ee24532a3616
Opcode Fuzzy Hash: d8e1660e306644a3059456114562463667108454f96654c664cb3035ad910b0d
Instruction Fuzzy Hash: 9A51B221B0864382EA90BB9994191B9E3A0BF62794FC54532EF1C677DEDF3CE5C58320

Function 00007FF8A82DADB0 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A82DADCE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82DADE6
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A82DADF8
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82DAE2B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82DAE43
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A82DAE52

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FF8A82DADDF, 00007FF8A82DAE3C, 00007FF8A82DB8DF
SSL_use_certificate, xrefs: 00007FF8A82DADD3, 00007FF8A82DAE30
ssl_set_cert, xrefs: 00007FF8A82DB8D3

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_rsa.c$SSL_use_certificate$ssl_set_cert
API String ID: 1552677711-2944039091
Opcode ID: 26d539224d6ffea8874f20852713715164ed6db8eeb8801a3fe6ea007f1f9233
Instruction ID: 2ca588a8118f1ae50178e0cb3627b9d1183d9d7ae9c4626f21a2da5a76b3962c
Opcode Fuzzy Hash: 26d539224d6ffea8874f20852713715164ed6db8eeb8801a3fe6ea007f1f9233
Instruction Fuzzy Hash: 9A31D821F1AA8562FB40E725E8017F95660FF997C4F9C4031EB4C47B9AEF2CD4508B28

Function 00007FF8A8014910 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 93COMMON

Download Yara Rule

APIs

PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FF8A801494E
PyUnicode_Compare.PYTHON312 ref: 00007FF8A80149B1
_Py_Dealloc.PYTHON312 ref: 00007FF8A80149C7

Strings

NFC, xrefs: 00007FF8A801493A
invalid normalization form, xrefs: 00007FF8A8014A2B
NFKC, xrefs: 00007FF8A80149D1
NFD, xrefs: 00007FF8A80149F1
NFKD, xrefs: 00007FF8A8014A09

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: CompareUnicode_$DeallocStringWith
String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
API String ID: 1004266020-3528878251
Opcode ID: f9f7669bc8d988216f82ec34d7818f873f2375af147d85eaf967d2e1963bb846
Instruction ID: 799e7bcbf83be1ac55e8ac7b5e5f594d7aad26f2746720dd1ab2669ad2a3d8d3
Opcode Fuzzy Hash: f9f7669bc8d988216f82ec34d7818f873f2375af147d85eaf967d2e1963bb846
Instruction Fuzzy Hash: 93314E31A0AA03E5EE158B12A95023563A2FF49BF4F944035DD4E8B7E0DF7CE465932C

Function 00007FF8A80124B0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PyModule_AddStringConstant.PYTHON312 ref: 00007FF8A80124D0
PyType_FromSpec.PYTHON312 ref: 00007FF8A80124E5
PyModule_AddType.PYTHON312 ref: 00007FF8A80124FD
_Py_Dealloc.PYTHON312 ref: 00007FF8A8013F76

Part of subcall function 00007FF8A80125A0: _PyObject_GC_New.PYTHON312(?,?,00000000,00007FF8A8012513), ref: 00007FF8A80125A6
Part of subcall function 00007FF8A80125A0: PyObject_GC_Track.PYTHON312(?,?,00000000,00007FF8A8012513), ref: 00007FF8A80125D8

PyModule_AddObject.PYTHON312 ref: 00007FF8A8012537
PyModule_AddObjectRef.PYTHON312 ref: 00007FF8A801255F
_Py_Dealloc.PYTHON312 ref: 00007FF8A8013F85

Strings

15.0.0, xrefs: 00007FF8A80124BF
unidata_version, xrefs: 00007FF8A80124C9
ucd_3_2_0, xrefs: 00007FF8A801252D
_ucnhash_CAPI, xrefs: 00007FF8A8012555

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Module_$DeallocObjectObject_$ConstantFromSpecStringTrackTypeType_
String ID: 15.0.0$_ucnhash_CAPI$ucd_3_2_0$unidata_version
API String ID: 2663085338-4141011787
Opcode ID: 9245d99d18ba6a28b06419a6239545a4791f8e2f4c0c976115bc78d49b54a1c7
Instruction ID: dad559946b44f94a6570596aa8ef3ca7d5f1af83975321b66ef695f0d5426858
Opcode Fuzzy Hash: 9245d99d18ba6a28b06419a6239545a4791f8e2f4c0c976115bc78d49b54a1c7
Instruction Fuzzy Hash: 64311431E0F603EAFF159B21A85427972A1EF49BF4F945034DA0D8A6D9DF7CE4648328

Function 00007FF8A80111B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 153COMMON

Download Yara Rule

APIs

PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FF8A80111E2
PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FF8A80111FA
PyType_IsSubtype.PYTHON312 ref: 00007FF8A801121D

Part of subcall function 00007FF8A80112F0: PyMem_Malloc.PYTHON312 ref: 00007FF8A8011376
Part of subcall function 00007FF8A80112F0: PyMem_Free.PYTHON312 ref: 00007FF8A801147C

PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FF8A801377B

Strings

NFC, xrefs: 00007FF8A80111D8
invalid normalization form, xrefs: 00007FF8A8013813
NFKC, xrefs: 00007FF8A80111F0
NFD, xrefs: 00007FF8A8013771
NFKD, xrefs: 00007FF8A80137B7

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: CompareStringUnicode_With$Mem_$FreeMallocSubtypeType_
String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
API String ID: 1723213316-3528878251
Opcode ID: 0183ee75f38b3d9b4e000f242270cd4c61522a137d2eba0fb5a9939ca12be486
Instruction ID: 7c53924382dda85af7af62dffb9a29b0431df632493e1a2e8f5a7472c7f08b7e
Opcode Fuzzy Hash: 0183ee75f38b3d9b4e000f242270cd4c61522a137d2eba0fb5a9939ca12be486
Instruction Fuzzy Hash: 6D519261B0E653E1FFA98B1595506796390EF25BE4F046131DD8E8BAC1EF3CE4318728

Function 00007FF8A80144E4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 109COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON312 ref: 00007FF8A8014514
PyType_IsSubtype.PYTHON312 ref: 00007FF8A8014577
PyUnicode_FromString.PYTHON312 ref: 00007FF8A8014593

Strings

argument, xrefs: 00007FF8A8014506
%04X, xrefs: 00007FF8A801463C
a unicode character, xrefs: 00007FF8A80144FF
, xrefs: 00007FF8A8014627
decomposition, xrefs: 00007FF8A801450D

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
String ID: $%04X$a unicode character$argument$decomposition
API String ID: 1318908108-4056541097
Opcode ID: 2aa5bcb769f9567ef44792d0b8645ff4acf96607a2464068c30a17cc2bf935c6
Instruction ID: 482738c8d263fa865d6a4bc76dfd1b0bc72496c0e160d5930055c37a9d660285
Opcode Fuzzy Hash: 2aa5bcb769f9567ef44792d0b8645ff4acf96607a2464068c30a17cc2bf935c6
Instruction Fuzzy Hash: 074105B2A0AA82E1EF218B14E8103B923A2FF49BF4F440235C95E476E5DF3CD565C324

Function 00007FF8A82B119F Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A82D2DD9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82D2DF1
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A82D2E03
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82D2E41
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82D2E59
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A82D2E6B

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A82D2DEA, 00007FF8A82D2E52, 00007FF8A82D2E91
SSL_read_early_data, xrefs: 00007FF8A82D2DDE, 00007FF8A82D2E46, 00007FF8A82D2E85

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_read_early_data
API String ID: 1552677711-1193762697
Opcode ID: 765441d96c8836d89b4b86551af9abb2bf4f61ae2aa69475af49dd773c5c7a39
Instruction ID: 779e3bdd3261792d9b7350239ef7701abaf0a81d7f90160549e46ecd97827f87
Opcode Fuzzy Hash: 765441d96c8836d89b4b86551af9abb2bf4f61ae2aa69475af49dd773c5c7a39
Instruction Fuzzy Hash: 3B41DA21B0AA42A6F7909B51D9017BE6AA0EB457C4F580431EF4D436D9DF7CF4518B28

Function 00007FF7B3C52180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7B3C521AB
SelectObject.GDI32 ref: 00007FF7B3C521F2
DrawTextW.USER32 ref: 00007FF7B3C52215
SelectObject.GDI32 ref: 00007FF7B3C5222B
ReleaseDC.USER32 ref: 00007FF7B3C5223B
MoveWindow.USER32 ref: 00007FF7B3C5228B
MoveWindow.USER32 ref: 00007FF7B3C522CB
MoveWindow.USER32 ref: 00007FF7B3C5231E
MoveWindow.USER32 ref: 00007FF7B3C52366

Strings

P%, xrefs: 00007FF7B3C521FF

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 94f815a0b936fdcf7090119a4db51ecc498bb651fc0e8f0e57adb77c3250663b
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 205108266047A186D6749F26E41C1BAF7A1FBA9B61F004125EFDE43694DF3CD085DB20

Function 00007FF7B3C580C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7B3C580FF
GetWindowLongPtrW.USER32 ref: 00007FF7B3C5817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF7B3C58192
GetLastError.KERNEL32 ref: 00007FF7B3C5819C
SetWindowLongPtrW.USER32 ref: 00007FF7B3C581B3

Strings

Needs to remove its temporary files., xrefs: 00007FF7B3C58185

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 47ef767a3b61cc62bf83fdd934bb9127d4ba3ef0950b025d7a034f325ec7a176
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 37217621B08A42C2E7816BFEA84D179A250FF96B91F994131DF2E533DCDE2CE5D18324

Function 00007FF8A81AD610 Relevance: 16.9, APIs: 2, Strings: 9, Instructions: 386COMMON

Download Yara Rule

Strings

no entry point [%s] in shared library [%s], xrefs: 00007FF8A81ADAAC
sqlite3_extension_init, xrefs: 00007FF8A81AD69A
not authorized, xrefs: 00007FF8A81AD683
%s.%s, xrefs: 00007FF8A81AD6DC
sqlite3_, xrefs: 00007FF8A81AD813
unable to open shared library [%.*s], xrefs: 00007FF8A81ADC1F
_init, xrefs: 00007FF8A81AD90E
lib, xrefs: 00007FF8A81AD861
error during initialization: %s, xrefs: 00007FF8A81AD9D6

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID: %s.%s$_init$error during initialization: %s$lib$no entry point [%s] in shared library [%s]$not authorized$sqlite3_$sqlite3_extension_init$unable to open shared library [%.*s]
API String ID: 0-3733955532
Opcode ID: b0ec9551d5566062c7935927163fb1022de54666d29d28a953ed04238243e4ec
Instruction ID: 83eeb2a599e999f79f2f22885a8d750440250627b820997abdd88b24969aefd6
Opcode Fuzzy Hash: b0ec9551d5566062c7935927163fb1022de54666d29d28a953ed04238243e4ec
Instruction Fuzzy Hash: 6402C361A0BE82A5EB6A8F21E4543B9B7A0FF45BC1F484535CE5E06799DF3CE444C328

Function 00007FF8A80146A8 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 62COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FF8A80146E7
_PyArg_BadArgument.PYTHON312 ref: 00007FF8A8014720
_PyUnicode_ToDigit.PYTHON312 ref: 00007FF8A8014740
PyErr_SetString.PYTHON312 ref: 00007FF8A8014760
PyLong_FromLong.PYTHON312 ref: 00007FF8A8014778

Strings

not a digit, xrefs: 00007FF8A8014756
digit, xrefs: 00007FF8A80146D7, 00007FF8A8014712
argument 1, xrefs: 00007FF8A8014719
a unicode character, xrefs: 00007FF8A801470B

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Arg_$ArgumentCheckDigitErr_FromLongLong_PositionalStringUnicode_
String ID: a unicode character$argument 1$digit$not a digit
API String ID: 4245020737-4278345224
Opcode ID: d2c025be6f32e1fa96eb3f1c6703f3e18d3fbf46a97c983d3ea169cd79d16b21
Instruction ID: 6b742b3d60af29f8d20289300a17c06e3c297beb6ea7b2be8b2526d758ed9348
Opcode Fuzzy Hash: d2c025be6f32e1fa96eb3f1c6703f3e18d3fbf46a97c983d3ea169cd79d16b21
Instruction Fuzzy Hash: FF219A35B0AA42E5EF508B12E4442786366FB46BE4F544036DE0E87BE4DF3DE465C328

Function 00007FF8A816B0C0 Relevance: 15.3, APIs: 2, Strings: 8, Instructions: 330COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8A816B1C3
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8A816B2A4

Strings

?, xrefs: 00007FF8A816B2B8
%lld, xrefs: 00007FF8A816B361
-- , xrefs: 00007FF8A816B153, 00007FF8A816B172
'%.*q', xrefs: 00007FF8A816B415
%02x, xrefs: 00007FF8A816B4C4
zeroblob(%d), xrefs: 00007FF8A816B460
%!.15g, xrefs: 00007FF8A816B37E
NULL, xrefs: 00007FF8A816B32D

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: %!.15g$%02x$%lld$'%.*q'$-- $?$NULL$zeroblob(%d)
API String ID: 3510742995-875588658
Opcode ID: 2bfb9ccf3173b77561383d7de2f52337ffb411a677cb446999baa6b05baa6e80
Instruction ID: 027d788116ade4f90233ad79bd8bb5bc977d3be58a8ffc19f2cdff43ba7d08ea
Opcode Fuzzy Hash: 2bfb9ccf3173b77561383d7de2f52337ffb411a677cb446999baa6b05baa6e80
Instruction Fuzzy Hash: 5AE17162F0A556AAFB23CB64D8903BC27A0FB057C8F444135DE8E52A99DF3CE445C368

Function 00007FF8A8187760 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 327COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A8187AD2

Strings

Cannot add a REFERENCES column with non-NULL default value, xrefs: 00007FF8A81878ED
UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q, xrefs: 00007FF8A8187B14
Cannot add a PRIMARY KEY column, xrefs: 00007FF8A8187881
Cannot add a column with non-constant default, xrefs: 00007FF8A8187969
Cannot add a UNIQUE column, xrefs: 00007FF8A818789C
SELECT raise(ABORT,%Q) FROM "%w"."%w", xrefs: 00007FF8A81878F7, 00007FF8A8187973, 00007FF8A8187A81
Cannot add a NOT NULL column with default value NULL, xrefs: 00007FF8A818790F
cannot add a STORED column, xrefs: 00007FF8A8187A72
SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE, xrefs: 00007FF8A8187C5C

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: Cannot add a NOT NULL column with default value NULL$Cannot add a PRIMARY KEY column$Cannot add a REFERENCES column with non-NULL default value$Cannot add a UNIQUE column$Cannot add a column with non-constant default$SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE$SELECT raise(ABORT,%Q) FROM "%w"."%w"$UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q$cannot add a STORED column
API String ID: 3510742995-200680935
Opcode ID: 5b4710b465af85f28d42b2c529d5cd9f71a28c578942a5c84c3729e8c5c3be64
Instruction ID: d8ea4fd57b3e2c43d39a52ce73e13ea852b8e8906cfc8960fedc7e64cd089fc8
Opcode Fuzzy Hash: 5b4710b465af85f28d42b2c529d5cd9f71a28c578942a5c84c3729e8c5c3be64
Instruction Fuzzy Hash: 24E1BD31A0EB82A5EB668B15A1453B973E1FB44BC4F084935CE9D07B99DF3CE541C328

Function 00007FF8A8012720 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8A8012748
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8A801279A
_RTC_Initialize.LIBCMT ref: 00007FF8A80127C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8A80127EE
__scrt_release_startup_lock.LIBCMT ref: 00007FF8A8012819

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: bc53fe8a0eda1481b36a314380ac74b5aff62c5ee69524d86cd6bd6c99e3d1c0
Instruction ID: fd83972c8a6d00c0d77322471cbfb667386daa19758a8776242d6ef3ef8fff2b
Opcode Fuzzy Hash: bc53fe8a0eda1481b36a314380ac74b5aff62c5ee69524d86cd6bd6c99e3d1c0
Instruction Fuzzy Hash: 4981BC21E0B243EEFE65EB6594412796291EF467E0F548039DA0C877D6EF3CE8658338

Function 00007FF7B3C66290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C662D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C666C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C6695C

Strings

p, xrefs: 00007FF7B3C66385
p, xrefs: 00007FF7B3C663FD
:, xrefs: 00007FF7B3C6648C
f, xrefs: 00007FF7B3C663F5
-, xrefs: 00007FF7B3C66369

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 997382328d551ac90675d67503e0f2309dfcc4914edaafd935f293d37c6fd4f5
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 2912A472E08243A6FBA07A99E118279F651EB63750FC44135D789976CCDF3CE5E08B24

Function 00007FF7B3C60FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C61008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C613D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C6166F

Strings

p, xrefs: 00007FF7B3C610AD
p, xrefs: 00007FF7B3C61112
f, xrefs: 00007FF7B3C61255
f, xrefs: 00007FF7B3C6110A
f, xrefs: 00007FF7B3C610A0

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 540e7af1dce3d02d913ff8c0034245ed4614d1bebe815ebecb4a471c76409b74
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 1C129772E0C14386FBA0BA99D058279F6A1FBA2755FC45035D79A976CCDB3CE4C08B60

Function 00007FF8A8140A30 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 135COMMON

Download Yara Rule

APIs

new[].MSPDB140-MSVCRT ref: 00007FF8A8140B47

Strings

:, xrefs: 00007FF8A8140A61
:, xrefs: 00007FF8A8140A9C
\, xrefs: 00007FF8A8140AB8
winFullPathname2, xrefs: 00007FF8A8140BB5
winFullPathname1, xrefs: 00007FF8A8140B2C
%s%c%s, xrefs: 00007FF8A8140AA6
?, xrefs: 00007FF8A8140A71

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: new[]
String ID: %s%c%s$:$:$?$\$winFullPathname1$winFullPathname2
API String ID: 4059295235-3840279414
Opcode ID: 7514e8fd5d93be79fc71e0024bcf4f49aeb845a9e117b097cb897556365a7ddf
Instruction ID: 58df108ffb9d66360bf3bda2b85730afac4335bdea5e8909c9553c1b57f682b6
Opcode Fuzzy Hash: 7514e8fd5d93be79fc71e0024bcf4f49aeb845a9e117b097cb897556365a7ddf
Instruction Fuzzy Hash: 9851F961E0E682A5FB979B62A4116B96BD1EF44BC8F484035DD4E03786CF7CE449C72C

Function 00007FF7B3C51050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7B3C510CC
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7B3C51108
fseek, xrefs: 00007FF7B3C510D3
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7B3C511F6
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7B3C51098
fread, xrefs: 00007FF7B3C511FD
malloc, xrefs: 00007FF7B3C5110F

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 4b5b6e3fcef3044075732b7736491b2407c08096ec4bb89f35b93de1ee291999
Instruction ID: f849588a2491b33499a2b1b4d6304c37fd60c5bbc7fa52d33d3fdb1970b00428
Opcode Fuzzy Hash: 4b5b6e3fcef3044075732b7736491b2407c08096ec4bb89f35b93de1ee291999
Instruction Fuzzy Hash: E7419322A0855281EA80FB99981D5BAE394FF66BC4FC54432EF0C677CDDE3CE5818760

Function 00007FF7B3C58660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF7B3C53CBB), ref: 00007FF7B3C58704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF7B3C53CBB), ref: 00007FF7B3C5870A
CreateDirectoryW.KERNEL32(?,00000000,00007FF7B3C53CBB), ref: 00007FF7B3C5874C

Part of subcall function 00007FF7B3C58830: GetEnvironmentVariableW.KERNEL32(00007FF7B3C5388E), ref: 00007FF7B3C58867
Part of subcall function 00007FF7B3C58830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7B3C58889

Part of subcall function 00007FF7B3C68238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C68251

Part of subcall function 00007FF7B3C52810: MessageBoxW.USER32 ref: 00007FF7B3C528EA

Strings

LOADER: failed to set the TMP environment variable., xrefs: 00007FF7B3C586DC
_MEI%d, xrefs: 00007FF7B3C58712
TMP, xrefs: 00007FF7B3C586C2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7B3C5877E
TMP, xrefs: 00007FF7B3C5869C, 00007FF7B3C587A3

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction ID: e0825204c6435b6209dd91c64bc6d2376bd70c62261624333ef93f4a48041bf6
Opcode Fuzzy Hash: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction Fuzzy Hash: E441A411B1964280EA90BBED985E2B99391AF677C0FC14032EF0D677DEDE3CE5858360

Function 00007FF8A82B1947 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A82B8D9D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82B8DB5
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A82B8DC7
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82B8DDC
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82B8DF4
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A82B8E06

Strings

..\s\ssl\d1_msg.c, xrefs: 00007FF8A82B8DAE, 00007FF8A82B8DED
dtls1_write_app_data_bytes, xrefs: 00007FF8A82B8DA2, 00007FF8A82B8DE1

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\d1_msg.c$dtls1_write_app_data_bytes
API String ID: 1552677711-1870589286
Opcode ID: b2aeda71e0f10ff5d104f444f2d6a97a66499aa94998217004147aa1704fb417
Instruction ID: e00636181128fcce537689571b3c41224738788eb5e3b6435a839b1fd621511c
Opcode Fuzzy Hash: b2aeda71e0f10ff5d104f444f2d6a97a66499aa94998217004147aa1704fb417
Instruction Fuzzy Hash: E9216220B0FB8765F750AB21E8043BA5250EF957D0F580135FA4D47BDAEF2CE4508768

Function 00007FF8A8172B90 Relevance: 14.0, APIs: 1, Strings: 8, Instructions: 489COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8172C5C

Strings

out of memory, xrefs: 00007FF8A8172CC8
no such column: "%s", xrefs: 00007FF8A81731C6
cannot open table without rowid: %s, xrefs: 00007FF8A81731D8
foreign key, xrefs: 00007FF8A8172E33
cannot open %s column for writing, xrefs: 00007FF8A8173194
indexed, xrefs: 00007FF8A8172E80
cannot open view: %s, xrefs: 00007FF8A81731CF
cannot open virtual table: %s, xrefs: 00007FF8A81731E1

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memset
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"$out of memory
API String ID: 2221118986-554953066
Opcode ID: 671fe0eef13a08e293cdff9a1a98f8760d5fa73be236d0a33e9a5ef0a7deb201
Instruction ID: f22678d24c4d6088db88ad844fe050edea03e92748fd05c2edd40c0107874b1b
Opcode Fuzzy Hash: 671fe0eef13a08e293cdff9a1a98f8760d5fa73be236d0a33e9a5ef0a7deb201
Instruction Fuzzy Hash: 8D32CD72A0AB81A6EB66CF25D4407B937A4FB48BC4F404139DE8E43799DF38E491CB14

Function 00007FF7B3C5EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7B3C5EA65

Part of subcall function 00007FF7B3C5F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF7B3C5F9FF
Part of subcall function 00007FF7B3C5F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7B3C5FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7B3C5EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7B3C5ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7B3C5EE98

Strings

csm, xrefs: 00007FF7B3C5EAE6
csm, xrefs: 00007FF7B3C5EA7F
csm, xrefs: 00007FF7B3C5EB60

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: ba31c4511fdfc2ea176533503db9b925f7ff3f875356967e74b0e91ea94f38d3
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 9DD1612290874185EBA0ABBD944A3BDB7A0FB66788F510136DF4D6779ADF38E0C4C711

Function 00007FF8A8137641 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 429COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8137B48

Strings

0123456789ABCDEF0123456789abcdef, xrefs: 00007FF8A8137A4C
-Inf, xrefs: 00007FF8A8137814
-, xrefs: 00007FF8A8137853
gfff, xrefs: 00007FF8A8137A9D
null, xrefs: 00007FF8A813772F
NaN, xrefs: 00007FF8A8137728
VUUU, xrefs: 00007FF8A81378DA

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memset
String ID: -$-Inf$0123456789ABCDEF0123456789abcdef$NaN$VUUU$gfff$null
API String ID: 2221118986-3207396689
Opcode ID: a6543f7ca9491b1445e2ecc135164382400244e23f1aff95d1367d86266735c3
Instruction ID: ee25a4b112dc07d2b2e2ec615b9873992f48402718734ae3727beffcd70a7fa6
Opcode Fuzzy Hash: a6543f7ca9491b1445e2ecc135164382400244e23f1aff95d1367d86266735c3
Instruction Fuzzy Hash: 6B0257A2E0E2C296F7A38A29915077E7BE1EB457C4F090A35DA8E477C5CF2CE541C724

Function 00007FF8A8192070 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 414COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A819210A

Strings

view, xrefs: 00007FF8A819219E, 00007FF8A81922B4
table, xrefs: 00007FF8A81921A5
%s %T already exists, xrefs: 00007FF8A81922AD
there is already an index named %s, xrefs: 00007FF8A819231E
sqlite_master, xrefs: 00007FF8A819208F, 00007FF8A81921F2, 00007FF8A8192544
sqlite_temp_master, xrefs: 00007FF8A81920C9, 00007FF8A81921CD
temporary table name must be unqualified, xrefs: 00007FF8A819213E

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: %s %T already exists$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3510742995-2846519077
Opcode ID: 84d25b8da552c185cdb89ee5e2906974b5069851bad6cc199998fa191b9faedd
Instruction ID: c2879f8b6cae6330f5e99e436baf6dd3b790af45dee403dceaf9405d21d1f4e1
Opcode Fuzzy Hash: 84d25b8da552c185cdb89ee5e2906974b5069851bad6cc199998fa191b9faedd
Instruction Fuzzy Hash: E102C072A0AB82A6EB26DF2194007B937A1FB85BC4F444235DE9D07B85DF3CE551C724

Function 00007FF7B3C6ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7B3C6F0AA,?,?,-00000018,00007FF7B3C6AD53,?,?,?,00007FF7B3C6AC4A,?,?,?,00007FF7B3C65F3E), ref: 00007FF7B3C6EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF7B3C6F0AA,?,?,-00000018,00007FF7B3C6AD53,?,?,?,00007FF7B3C6AC4A,?,?,?,00007FF7B3C65F3E), ref: 00007FF7B3C6EE98

Strings

ext-ms-, xrefs: 00007FF7B3C6EDE9
api-ms-, xrefs: 00007FF7B3C6EDD6

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 9d378fc789808820c98afc50fc3eced53b48891d93ae337d3fff8002a9ae29f8
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 0341182171961141EB95ABAE9908179A291BF67B90FC44536DE1DA73CCEF3CE4858210

Function 00007FF7B3C52C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B3C53706,?,00007FF7B3C53804), ref: 00007FF7B3C52C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B3C53706,?,00007FF7B3C53804), ref: 00007FF7B3C52D63
MessageBoxW.USER32 ref: 00007FF7B3C52D99

Strings

[PYI-%d:ERROR] , xrefs: 00007FF7B3C52CA6
<FormatMessageW failed.>, xrefs: 00007FF7B3C52D70
%ls: , xrefs: 00007FF7B3C52D22
Error, xrefs: 00007FF7B3C52D8C

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: 5c8245ed5d686ca998c5b45913c2c10cbd93d106ac65baeaec793f72d1947c07
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: 26311A22708A4042E660BB69A8092BBB691BF957C8F814136DF4D6379DDF3CD586C310

Function 00007FF8A8188C10 Relevance: 12.3, APIs: 6, Strings: 2, Instructions: 299COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8188D3F
memset.VCRUNTIME140 ref: 00007FF8A8188E01
memcpy.VCRUNTIME140 ref: 00007FF8A8188E2D
memcpy.VCRUNTIME140 ref: 00007FF8A8188EFC
memmove.VCRUNTIME140 ref: 00007FF8A8188FDC
memcpy.VCRUNTIME140 ref: 00007FF8A8188FFC

Strings

%Q%s, xrefs: 00007FF8A8188F62
"%w" , xrefs: 00007FF8A8188CBB

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy$memset$memmove
String ID: "%w" $%Q%s
API String ID: 3094553269-1987291987
Opcode ID: bc9c6ca1a757e72d87f3bb67fe0aded761ee375aafaa4476b2c106209e26902c
Instruction ID: a3f2c4141e185946079b8b6996c3e059a5fc8958035b72ccc9d918209b5c3d70
Opcode Fuzzy Hash: bc9c6ca1a757e72d87f3bb67fe0aded761ee375aafaa4476b2c106209e26902c
Instruction Fuzzy Hash: 0FC11322A0AB82A6EA56CF16E44027977A1FF45BE0F144235EE6E077D9DF3CE450C724

Function 00007FF8A8151040 Relevance: 12.3, APIs: 5, Strings: 3, Instructions: 253COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A8151317
memcpy.VCRUNTIME140 ref: 00007FF8A8151385

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A81510C2
%s at line %d of [%.10s], xrefs: 00007FF8A81510DA
database corruption, xrefs: 00007FF8A81510CE

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3510742995-3727861699
Opcode ID: d19dcd5255650cfdfefce16a649fffea8f53c40fce7bdf3c810c1306d021ea72
Instruction ID: 972b14897f88965efe45d61a5f53e165a0ad8070f110773a7b9486aea01c2141
Opcode Fuzzy Hash: d19dcd5255650cfdfefce16a649fffea8f53c40fce7bdf3c810c1306d021ea72
Instruction Fuzzy Hash: 48A10362A0E2D1A6D72A8B19D4906BE7B92FB807C1F145235DBCB83785DF3CD055C724

Function 00007FF8A82D6940 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3(?,00007FF8A82D02C1), ref: 00007FF8A82D6984
OPENSSL_sk_num.LIBCRYPTO-3(?,00007FF8A82D02C1), ref: 00007FF8A82D699B
OPENSSL_sk_value.LIBCRYPTO-3(?,00007FF8A82D02C1), ref: 00007FF8A82D69A9
X509_NAME_dup.LIBCRYPTO-3(?,00007FF8A82D02C1), ref: 00007FF8A82D69B1
OPENSSL_sk_num.LIBCRYPTO-3(?,00007FF8A82D02C1), ref: 00007FF8A82D69D5

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: L_sk_num$E_dupL_sk_new_nullL_sk_valueX509_
String ID:
API String ID: 3273602126-0
Opcode ID: 881ac52d8e42a3e634f706a0947f41ac1587dba43d80824104df64d6d3a7b18e
Instruction ID: 74c47aa2ceb51caa3076e8bc4cae05995b165386a779624395ce6f26fed7a0c7
Opcode Fuzzy Hash: 881ac52d8e42a3e634f706a0947f41ac1587dba43d80824104df64d6d3a7b18e
Instruction Fuzzy Hash: 3C21B320B0FB4255FF90DB66A5411B95A90EF58BC4F580030EE8E47B9BEF7DE4018768

Function 00007FF8A8142CE0 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 339COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A814309A

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A8142D53, 00007FF8A8142EE9
misuse, xrefs: 00007FF8A8142E89, 00007FF8A8142EF6
API called with NULL prepared statement, xrefs: 00007FF8A8142E44
%s at line %d of [%.10s], xrefs: 00007FF8A8142E95, 00007FF8A8142F02
API called with finalized prepared statement, xrefs: 00007FF8A8142E5C, 00007FF8A8142ED8
ATTACH x AS %Q, xrefs: 00007FF8A8142D70

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API called with NULL prepared statement$API called with finalized prepared statement$ATTACH x AS %Q$misuse
API String ID: 3510742995-1404302391
Opcode ID: 8ce0bce7dde3a7cc6d609d5fdf3d34c648de0cfc592bf91cd3842dd1b93a9340
Instruction ID: 07be25e6718e17c4ad6c8ff6ebadab9f9ed99082244ba80280cb1ff460a60843
Opcode Fuzzy Hash: 8ce0bce7dde3a7cc6d609d5fdf3d34c648de0cfc592bf91cd3842dd1b93a9340
Instruction Fuzzy Hash: ACF18865A0BB42E6EB669B61A84477933A4FF80BD0F544135CA4E07799CF3CE885C328

Function 00007FF8A81B43D0 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 334COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A81B4559

Strings

table, xrefs: 00007FF8A81B43FA
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 00007FF8A81B474F
sqlite_master, xrefs: 00007FF8A81B441C
CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text), xrefs: 00007FF8A81B4474
sqlite_temp_master, xrefs: 00007FF8A81B4415
ase, xrefs: 00007FF8A81B465D

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)$SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master$table
API String ID: 3510742995-879093740
Opcode ID: ff314089cfb3144469407ac8478c4dd78395d05d9342c5cffda655108caeca0f
Instruction ID: be04af7e45b0eda61c1519d2bb54b747bddc6e0c49e3f82543d078cd34c0f437
Opcode Fuzzy Hash: ff314089cfb3144469407ac8478c4dd78395d05d9342c5cffda655108caeca0f
Instruction Fuzzy Hash: 47E1CE22F0AB91AAFB16CB65D0442BC27A9FB45BC8F058235CE0D57795DF38E852C364

Function 00007FF8A80116D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FF8A80117A8
PyUnicode_FromString.PYTHON312 ref: 00007FF8A801180C
_PyArg_BadArgument.PYTHON312 ref: 00007FF8A80139C2

Strings

argument, xrefs: 00007FF8A80139B4
category, xrefs: 00007FF8A80139BB
a unicode character, xrefs: 00007FF8A80139AD

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
String ID: a unicode character$argument$category
API String ID: 1318908108-2068800536
Opcode ID: c31e599aff6ce8fd118d7930930d13bb61e4023c7ccaaddb711cf16cebfbc0cd
Instruction ID: 1d18a3693edb7d4d59802c1698a0265c213e4b46dc7e24e55db4d0a031e8382c
Opcode Fuzzy Hash: c31e599aff6ce8fd118d7930930d13bb61e4023c7ccaaddb711cf16cebfbc0cd
Instruction Fuzzy Hash: A451D762B1A656E2EF598B05D4502B823A1FF54BE4F545035EACE87BD0CF3CE865C328

Function 00007FF8A8011000 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FF8A80110D3
PyUnicode_FromString.PYTHON312 ref: 00007FF8A80110F8
_PyArg_BadArgument.PYTHON312 ref: 00007FF8A8013690

Strings

argument, xrefs: 00007FF8A8013682
a unicode character, xrefs: 00007FF8A801367B
bidirectional, xrefs: 00007FF8A8013689

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
String ID: a unicode character$argument$bidirectional
API String ID: 1318908108-2110215792
Opcode ID: 2be184d8cc6ee1ee00809d45acc887d572eb9887141ab2374770304697e252f3
Instruction ID: 5877930b240b6a1cb6165fc838bc58a14169cd628a8c2aed9fd0dec4858524ff
Opcode Fuzzy Hash: 2be184d8cc6ee1ee00809d45acc887d572eb9887141ab2374770304697e252f3
Instruction Fuzzy Hash: 0241E662F1A683E2EF598B05D4513796361FB14BE0F446035DA9E476D4CF3DE8A1C328

Function 00007FF8A82B215D Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A82E1680: ERR_new.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FF8A82E2C00), ref: 00007FF8A82E1745
Part of subcall function 00007FF8A82E1680: ERR_set_debug.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FF8A82E2C00), ref: 00007FF8A82E1765

OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FF8A82E2E48

Strings

, xrefs: 00007FF8A82E2EB7
master secret, xrefs: 00007FF8A82E2ECF
0, xrefs: 00007FF8A82E2E86
extended master secret, xrefs: 00007FF8A82E2E1F
, xrefs: 00007FF8A82E2ED6

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: L_cleanseR_newR_set_debug
String ID: $ $0$extended master secret$master secret
API String ID: 4043487175-741269486
Opcode ID: 632837cd04c36d3e08a8e14a74e7fba73ae231988af0ccfaa73eecf7652ab137
Instruction ID: 1230cffacc529f5f90ab849f05a38660ecce0bd1b0959819ec07ce41b97842b5
Opcode Fuzzy Hash: 632837cd04c36d3e08a8e14a74e7fba73ae231988af0ccfaa73eecf7652ab137
Instruction Fuzzy Hash: A3414D72609B8196E720CB15F8403AAB6E4FB887C4F584035EACD43B69EF7DE151CB18

Function 00007FF7B3C5DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7B3C5DF7A,?,?,?,00007FF7B3C5DC6C,?,?,?,00007FF7B3C5D869), ref: 00007FF7B3C5DD4D
GetLastError.KERNEL32(?,?,?,00007FF7B3C5DF7A,?,?,?,00007FF7B3C5DC6C,?,?,?,00007FF7B3C5D869), ref: 00007FF7B3C5DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7B3C5DF7A,?,?,?,00007FF7B3C5DC6C,?,?,?,00007FF7B3C5D869), ref: 00007FF7B3C5DD85
FreeLibrary.KERNEL32(?,?,?,00007FF7B3C5DF7A,?,?,?,00007FF7B3C5DC6C,?,?,?,00007FF7B3C5D869), ref: 00007FF7B3C5DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF7B3C5DF7A,?,?,?,00007FF7B3C5DC6C,?,?,?,00007FF7B3C5D869), ref: 00007FF7B3C5DDFF

Strings

api-ms-, xrefs: 00007FF7B3C5DD6D

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: c9b552db6d1bb766d972eb34f9d201ff8dd5009625df7f7d204d7d17558e9e66
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 4A31B721B19701D1EE91BB8A940D175A394FF66B90FDA0536DF1D563C8EE3CE4848230

Function 00007FF7B3C52A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7B3C5351A,?,00000000,00007FF7B3C53F1B), ref: 00007FF7B3C52AA0

Strings

[PYI-%d:%s] , xrefs: 00007FF7B3C52AA8
Warning, xrefs: 00007FF7B3C52B1E
Warning [ANSI Fallback], xrefs: 00007FF7B3C52B0F
WARNING, xrefs: 00007FF7B3C52AAF
0, xrefs: 00007FF7B3C52B16

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 1bbb40c60a4bc58c18098b3612355bcede45f113cb38361d8ad5fa5398c260c6
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 5721913261878192E760AB99F4497E6B394FB99384F804132EF8D6369DDF3CD1858750

Function 00007FF7B3C58570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7B3C58590
OpenProcessToken.ADVAPI32 ref: 00007FF7B3C585A3
GetTokenInformation.ADVAPI32 ref: 00007FF7B3C585C8
GetLastError.KERNEL32 ref: 00007FF7B3C585D2
GetTokenInformation.ADVAPI32 ref: 00007FF7B3C58612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7B3C5862E
CloseHandle.KERNEL32 ref: 00007FF7B3C58646

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction ID: a1b571f4041bd252ef74bdd12c4116b6b8674f7c74c71e1f6470bc4ecf962fbd
Opcode Fuzzy Hash: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction Fuzzy Hash: BB217821B0C74682EB906B9DB54913AE3A0FF927A0F900235EB6D536DCDE7CE4858710

Function 00007FF7B3C6B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7B3C6B15F
FlsGetValue.KERNEL32 ref: 00007FF7B3C6B174
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B195
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B1C2
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B1D3
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B1E4
SetLastError.KERNEL32 ref: 00007FF7B3C6B1FF

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
Instruction ID: 8b166bfebc305ee8280acaf49bc7d57ade1c310229ebd09489ad6bfd9aefab28
Opcode Fuzzy Hash: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
Instruction Fuzzy Hash: 70216D20B0C64281FAD873FE965D13DD2825F667A0F904634DB2EA76CEDE2DB4C14320

Function 00007FF8A82FED20 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A82FED44
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82FED5C
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82FEDA9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82FEDC1

Strings

final_ems, xrefs: 00007FF8A82FED49, 00007FF8A82FEDAE
..\s\ssl\statem\extensions.c, xrefs: 00007FF8A82FED55, 00007FF8A82FEDBA

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions.c$final_ems
API String ID: 193678381-1856277603
Opcode ID: c3d21715f82fb750d369fd897d142e96d67486cf357ddeff4b98377adb5b5872
Instruction ID: b405893e3a99882df94ccc1a9b9b162f2a1a265859b9370f01b0db7711e1a553
Opcode Fuzzy Hash: c3d21715f82fb750d369fd897d142e96d67486cf357ddeff4b98377adb5b5872
Instruction Fuzzy Hash: F7110124F0B64366FB94A366D8097F81201EB95780F884031C50C06ADADF7DE9A6C328

Function 00007FF7B3C77D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7B3C77D9D
GetLastError.KERNEL32 ref: 00007FF7B3C77DA9
CloseHandle.KERNEL32 ref: 00007FF7B3C77DC1
CreateFileW.KERNEL32 ref: 00007FF7B3C77DEC
WriteConsoleW.KERNEL32 ref: 00007FF7B3C77E0B

Strings

CONOUT$, xrefs: 00007FF7B3C77DCD

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: 4048fc2987edd5c2e8156e35978a8ec6c283135a5145b0090c9cd49cb9db0b3b
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 0011EB21A18A4186E7905B99E44C335B2A0FB59BE1F400234DF1D977D8CF3CD9808750

Function 00007FF8A8011150 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FF8A80136E7
_PyArg_BadArgument.PYTHON312 ref: 00007FF8A801371A

Part of subcall function 00007FF8A80111B0: PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FF8A80111E2
Part of subcall function 00007FF8A80111B0: PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FF8A80111FA
Part of subcall function 00007FF8A80111B0: PyType_IsSubtype.PYTHON312 ref: 00007FF8A801121D

Strings

normalize, xrefs: 00007FF8A80136DA, 00007FF8A8013713
str, xrefs: 00007FF8A801370C
argument 1, xrefs: 00007FF8A80136F9
argument 2, xrefs: 00007FF8A8013705

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Arg_CompareStringUnicode_With$ArgumentCheckPositionalSubtypeType_
String ID: argument 1$argument 2$normalize$str
API String ID: 4101545800-1320425463
Opcode ID: 6a3206665d50624963465f038f79663c2d3d68664346081dad0779ef5a43a2b4
Instruction ID: b2f757c98c261e4837b2f930db03802078b12907fc7fa6fa87689527ab55d257
Opcode Fuzzy Hash: 6a3206665d50624963465f038f79663c2d3d68664346081dad0779ef5a43a2b4
Instruction Fuzzy Hash: 1311A1A1B0A686E4EF648B12E4816BAA360EF05FD4F498036D94D0B7D4DF3CD4A4D368

Function 00007FF8A8014870 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FF8A801489C
_PyArg_BadArgument.PYTHON312 ref: 00007FF8A80148D1

Strings

str, xrefs: 00007FF8A80148C3
is_normalized, xrefs: 00007FF8A801488F, 00007FF8A80148CA
argument 1, xrefs: 00007FF8A80148BC
argument 2, xrefs: 00007FF8A80148F2

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: argument 1$argument 2$is_normalized$str
API String ID: 3876575403-184702317
Opcode ID: 7c950a274d1c530a4e2b2ee5c75bc666441a244dd8d061769435580234d1272f
Instruction ID: 6f43357f627c38b1088db55aabf0b93eb69f0678879e180b94689a1f1ccd9d4f
Opcode Fuzzy Hash: 7c950a274d1c530a4e2b2ee5c75bc666441a244dd8d061769435580234d1272f
Instruction Fuzzy Hash: B5018B60F0AA86E4EE508B42E4817BA2361FF44FE4F448036D90D0B2E4CF3CD4A9C368

Function 00007FF8A8196680 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 338COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A81967CB
memcpy.VCRUNTIME140 ref: 00007FF8A8196812
memcpy.VCRUNTIME140 ref: 00007FF8A8196A9E

Strings

unknown column "%s" in foreign key definition, xrefs: 00007FF8A8196A2E
foreign key on %s should reference only one column of table %T, xrefs: 00007FF8A8196705
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00007FF8A819672E

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 438689982-272990098
Opcode ID: b6741757eca0bf7286eb3d6c9d7d1b647278b2c452c400655b403082623ecb95
Instruction ID: b6dc5e3d3e25a822302bb2d163130bc3ff8bf301550e70dfe43bf6a4c960bc3c
Opcode Fuzzy Hash: b6741757eca0bf7286eb3d6c9d7d1b647278b2c452c400655b403082623ecb95
Instruction Fuzzy Hash: 7ED10372B0AF82A6EB66CB1594446BA7BA1FB45BD4F844131DE6E03785DF3CE441C328

Function 00007FF8A81555D0 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A815579D
memcpy.VCRUNTIME140 ref: 00007FF8A8155985
memcpy.VCRUNTIME140 ref: 00007FF8A815599A

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A8155615
%s at line %d of [%.10s], xrefs: 00007FF8A815562D
database corruption, xrefs: 00007FF8A8155621

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy$memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 438689982-3727861699
Opcode ID: 5dc20ad9749f576e2bdd85d432535949bff597f47a50de2b10b80a5b4d618dbe
Instruction ID: 5a31d670915853fff02adeece696e13077ccb3263e44a9fde58418c2e62985b8
Opcode Fuzzy Hash: 5dc20ad9749f576e2bdd85d432535949bff597f47a50de2b10b80a5b4d618dbe
Instruction Fuzzy Hash: BFD1EF72A0A681D6DB69CF29E0447BAB7A1FB84B88F515032DE4D47784EF3ED840C714

Function 00007FF8A81592C0 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 217COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A815937B
memmove.VCRUNTIME140 ref: 00007FF8A815940D
memmove.VCRUNTIME140 ref: 00007FF8A815948C

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A815933D
%s at line %d of [%.10s], xrefs: 00007FF8A8159355
database corruption, xrefs: 00007FF8A8159349

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2162964266-3727861699
Opcode ID: 0f045e69ece5e58a5605bba3c1eb72ead89470c58f18165752d3b17f3c0f85b3
Instruction ID: 06d438a75ef160695f68cb7be0ba48a7ddccd7d3a5ca557440010fcda3bc67ce
Opcode Fuzzy Hash: 0f045e69ece5e58a5605bba3c1eb72ead89470c58f18165752d3b17f3c0f85b3
Instruction Fuzzy Hash: 389112A3A0A6C59BCB25CB25E5802AEBBA0FB44BC8F445132DE8E43B45EF3CD155C715

Function 00007FF8A8187CA0 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 215COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8187E64
memcpy.VCRUNTIME140 ref: 00007FF8A8187EAE
memcpy.VCRUNTIME140 ref: 00007FF8A8187F19

Strings

Cannot add a column to a view, xrefs: 00007FF8A8187D54
sqlite_altertab_%s, xrefs: 00007FF8A8187E6D
virtual tables may not be altered, xrefs: 00007FF8A8187D38

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy$memset
String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
API String ID: 438689982-2063813899
Opcode ID: 0f4a477d62f3d65d23696e639a11322eccfa21096bcd5279f8ee82e5454cacc9
Instruction ID: 8a0d69a0329ec2a59c5e56253929f975d14b1df286580d1cb80a174f2fb89390
Opcode Fuzzy Hash: 0f4a477d62f3d65d23696e639a11322eccfa21096bcd5279f8ee82e5454cacc9
Instruction Fuzzy Hash: A9910162A0AB8592EB62CF12E4052B977E5FB88BC0F458635EE9D07785EF3CE441C314

Function 00007FF8A8158690 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A815884C
memmove.VCRUNTIME140 ref: 00007FF8A8158884
memcpy.VCRUNTIME140 ref: 00007FF8A8158951

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A815872C
%s at line %d of [%.10s], xrefs: 00007FF8A8158746
database corruption, xrefs: 00007FF8A815873F

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy$memmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 1283327689-3727861699
Opcode ID: 18ed6f349fa8df90b545674691f7bb4008a36ffe479325eff14730e8886acda7
Instruction ID: 83bff7a373f7b14a4f3dda230c87a0b24cc78f7075647e4bf8f5ae62238c408a
Opcode Fuzzy Hash: 18ed6f349fa8df90b545674691f7bb4008a36ffe479325eff14730e8886acda7
Instruction Fuzzy Hash: 5F91F862A096C1A6D71ACB26D1802BE77E0FB81BC4F045132DB8E87785DF3CE465C764

Function 00007FF8A8168F60 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 139COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-8000000000000000,?,00000000,00007FF8A81AD0A0), ref: 00007FF8A81690FD

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A8168FAA
misuse, xrefs: 00007FF8A8168FB7
API called with NULL prepared statement, xrefs: 00007FF8A8168F74
%s at line %d of [%.10s], xrefs: 00007FF8A8168FC3
API called with finalized prepared statement, xrefs: 00007FF8A8168F8C

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API called with NULL prepared statement$API called with finalized prepared statement$misuse
API String ID: 3510742995-3538577999
Opcode ID: 3facb6c6f69657c9aac68e5e72037591cf2385d6111726e0645f2351e47175fe
Instruction ID: 0eefe5cf346a333082750efd63c18786ec780752a6f780c248d5f8a489dec013
Opcode Fuzzy Hash: 3facb6c6f69657c9aac68e5e72037591cf2385d6111726e0645f2351e47175fe
Instruction Fuzzy Hash: E651D122B0F652A6FB579B2594102B96395EF41BE0F184131CE9D073C9EF3DE442C368

Function 00007FF7B3C58ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF7B3C53FA9), ref: 00007FF7B3C58EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF7B3C53FA9), ref: 00007FF7B3C58F5A

Part of subcall function 00007FF7B3C59390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7B3C545F4,00000000,00007FF7B3C51985), ref: 00007FF7B3C593C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7B3C53FA9), ref: 00007FF7B3C58FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7B3C53FA9), ref: 00007FF7B3C59044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7B3C53FA9), ref: 00007FF7B3C59055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7B3C53FA9), ref: 00007FF7B3C5906A

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction ID: 979c67733a0adcf528c57302450f636bc795e95a526e9fc4c10eb766de6d2b0a
Opcode Fuzzy Hash: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction Fuzzy Hash: C641FA22B1968181EAB0AB55A4092BAB394FF9ABC4F854536DF4DA77CDDF3CD180C710

Function 00007FF7B3C590E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B3C58570: GetCurrentProcess.KERNEL32 ref: 00007FF7B3C58590
Part of subcall function 00007FF7B3C58570: OpenProcessToken.ADVAPI32 ref: 00007FF7B3C585A3
Part of subcall function 00007FF7B3C58570: GetTokenInformation.ADVAPI32 ref: 00007FF7B3C585C8
Part of subcall function 00007FF7B3C58570: GetLastError.KERNEL32 ref: 00007FF7B3C585D2
Part of subcall function 00007FF7B3C58570: GetTokenInformation.ADVAPI32 ref: 00007FF7B3C58612
Part of subcall function 00007FF7B3C58570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7B3C5862E
Part of subcall function 00007FF7B3C58570: CloseHandle.KERNEL32 ref: 00007FF7B3C58646

LocalFree.KERNEL32(?,00007FF7B3C53C55), ref: 00007FF7B3C5916C
LocalFree.KERNEL32(?,00007FF7B3C53C55), ref: 00007FF7B3C59175

Strings

S-1-3-4, xrefs: 00007FF7B3C59121
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7B3C59183
D:(A;;FA;;;%s), xrefs: 00007FF7B3C59157
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7B3C59142

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: 89c47cd2a938f15830779e69dd49d13590687abd7bb9d1fae088e5f1a45b95d5
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: E6214121A0874181F690BB98E41E2FAA250FFA6780FC54036EB4D637DADF3DD585C760

Function 00007FF7B3C6B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7B3C64F11,?,?,?,?,00007FF7B3C6A48A,?,?,?,?,00007FF7B3C6718F), ref: 00007FF7B3C6B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C64F11,?,?,?,?,00007FF7B3C6A48A,?,?,?,?,00007FF7B3C6718F), ref: 00007FF7B3C6B30D
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C64F11,?,?,?,?,00007FF7B3C6A48A,?,?,?,?,00007FF7B3C6718F), ref: 00007FF7B3C6B33A
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C64F11,?,?,?,?,00007FF7B3C6A48A,?,?,?,?,00007FF7B3C6718F), ref: 00007FF7B3C6B34B
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C64F11,?,?,?,?,00007FF7B3C6A48A,?,?,?,?,00007FF7B3C6718F), ref: 00007FF7B3C6B35C
SetLastError.KERNEL32(?,?,?,00007FF7B3C64F11,?,?,?,?,00007FF7B3C6A48A,?,?,?,?,00007FF7B3C6718F), ref: 00007FF7B3C6B377

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
Instruction ID: 0e134783679fb627603b1d3e9e8b3dba043dda7923cd6cec83aeb97e088b79a9
Opcode Fuzzy Hash: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
Instruction Fuzzy Hash: 9B113020B0C64281FAD477FE565D13DD2419FA67B0F944634DB2EA76DEDE6CA4814320

Function 00007FF7B3C52910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7B3C51B6A), ref: 00007FF7B3C5295E

Strings

[PYI-%d:ERROR] , xrefs: 00007FF7B3C52966
Error [ANSI Fallback], xrefs: 00007FF7B3C529FF
%s: %s, xrefs: 00007FF7B3C529E8
Error, xrefs: 00007FF7B3C52A0E

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: 5ec517839e3f72287d8735ed5dca443fc5637064c09c832755b6606a3245c5ae
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: 7B31E722B1868152E750BBA9A8492F7B294BF957D4F814132EF8DA378DDF3CD586C210

Function 00007FF7B3C52390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7B3C523C8
DialogBoxIndirectParamW.USER32 ref: 00007FF7B3C5248E
DeleteObject.GDI32 ref: 00007FF7B3C524C1
DestroyIcon.USER32 ref: 00007FF7B3C524D3

Strings

Unhandled exception in script, xrefs: 00007FF7B3C523F8

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction ID: 963f92ebf7390bb933a347c45fde3facf4602241043e9a66e25aa4f8b4c7b74c
Opcode Fuzzy Hash: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction Fuzzy Hash: 3531607661968184EB60AFA5E8592FAA390FF9A784F800135EF4D57B8DDF3CD1808710

Function 00007FF7B3C52B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF7B3C5918F,?,00007FF7B3C53C55), ref: 00007FF7B3C52BA0
MessageBoxW.USER32 ref: 00007FF7B3C52C2A

Strings

[PYI-%d:%ls] , xrefs: 00007FF7B3C52BA8
WARNING, xrefs: 00007FF7B3C52BAF
Warning, xrefs: 00007FF7B3C52C1D

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: 4142753221cb55f3d67f72a9499f753b9a25ea5dead2623ad0bdcc573d8cbd57
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: 7721D622708B4181E750AB98F4497AAB394EB99784F804136EF4D63699DF3CD285C750

Function 00007FF7B3C52710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7B3C51B99), ref: 00007FF7B3C52760

Strings

[PYI-%d:%s] , xrefs: 00007FF7B3C52768
Error [ANSI Fallback], xrefs: 00007FF7B3C527CF
Error, xrefs: 00007FF7B3C527DE
ERROR, xrefs: 00007FF7B3C5276F

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: f69ad2ecf8a1a02a0d497b7f379964aa1ea7bac998a7c10bfd96a1f6726751d6
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: 65219132A1878192E750AB99F4497E6A394EB99384F800132EF8D6369DDF7CD1858750

Function 00007FF8A801479C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON312 ref: 00007FF8A80147CC
PyType_IsSubtype.PYTHON312 ref: 00007FF8A801482C

Strings

argument, xrefs: 00007FF8A80147BE
a unicode character, xrefs: 00007FF8A80147B7
east_asian_width, xrefs: 00007FF8A80147C5

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Arg_ArgumentSubtypeType_
String ID: a unicode character$argument$east_asian_width
API String ID: 1522575347-3913127203
Opcode ID: 7b891638b4a45313673a93616f0d216ddcfc167a757208e07fea525010fbe4c5
Instruction ID: 7e5f5d05560e9eed73effbc310a48fe773eba00baf475d0f736cd61b8e84e605
Opcode Fuzzy Hash: 7b891638b4a45313673a93616f0d216ddcfc167a757208e07fea525010fbe4c5
Instruction Fuzzy Hash: AD219D21F0AA83E5EF558B12945427D67A2FF45BE0F488035DA1D47AE0DF3CE4A5C368

Function 00007FF8A8014D5C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FF8A8014D88
_PyUnicode_ToNumeric.PYTHON312 ref: 00007FF8A8014DBB
PyErr_SetString.PYTHON312 ref: 00007FF8A8014DE3
PyFloat_FromDouble.PYTHON312 ref: 00007FF8A8014DFB

Strings

not a numeric character, xrefs: 00007FF8A8014DD9

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: DoubleErr_Float_FromNumericStringSubtypeType_Unicode_
String ID: not a numeric character
API String ID: 1034370217-2058156748
Opcode ID: fcf580e983b79c5798e6cad288af339b3c77563d47c350b9cfeb4f794997e3db
Instruction ID: c2b83bcc6fd19a12e609daa4fe73526918717ded08eebd6f810207b0d06b4f21
Opcode Fuzzy Hash: fcf580e983b79c5798e6cad288af339b3c77563d47c350b9cfeb4f794997e3db
Instruction Fuzzy Hash: D321C331A0AD42E5EF558B25D41003866A2FF45BE4F044170D90E8B6F0EF3CE8A68768

Function 00007FF8A8014448 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FF8A8014474
_PyUnicode_ToDecimalDigit.PYTHON312 ref: 00007FF8A8014493
PyErr_SetString.PYTHON312 ref: 00007FF8A80144B3
PyLong_FromLong.PYTHON312 ref: 00007FF8A80144CD

Strings

not a decimal, xrefs: 00007FF8A80144A9

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: DecimalDigitErr_FromLongLong_StringSubtypeType_Unicode_
String ID: not a decimal
API String ID: 3750391552-3590249192
Opcode ID: 30abf5ee6eb06e173e75edeec379c503cf6988d9432b31e93c7c03d97c2bbd6f
Instruction ID: efc1467589e46cf8f78d9a6c0c940b243af5e74027f5b4cd3a43c107f14cfd72
Opcode Fuzzy Hash: 30abf5ee6eb06e173e75edeec379c503cf6988d9432b31e93c7c03d97c2bbd6f
Instruction Fuzzy Hash: 1B115832B0A942E2FF558B15E4941396392FF58BE4F484434CA4D877E4DF3CE4619368

Function 00007FF8A8014B60 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FF8A8014B9F
_PyArg_BadArgument.PYTHON312 ref: 00007FF8A8014BD4

Strings

argument 1, xrefs: 00007FF8A8014BCD
name, xrefs: 00007FF8A8014B8F, 00007FF8A8014BC6
a unicode character, xrefs: 00007FF8A8014BBF

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: a unicode character$argument 1$name
API String ID: 3876575403-4190364640
Opcode ID: ec6e6ed6f870309110939f004844dac450691aedb088de06c3465004018691fb
Instruction ID: 7a36c5a4b81a9c4f47bc58b9e97b8801fe026be749d45db4f618a2913dcb5782
Opcode Fuzzy Hash: ec6e6ed6f870309110939f004844dac450691aedb088de06c3465004018691fb
Instruction Fuzzy Hash: F211CE31F0AA82E1EE509B42E4812A96361FB44BD4F588036DE0D477A5CF3DE5A5C324

Function 00007FF8A8014390 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FF8A80143CF
_PyArg_BadArgument.PYTHON312 ref: 00007FF8A8014404

Strings

decimal, xrefs: 00007FF8A80143BF, 00007FF8A80143F6
argument 1, xrefs: 00007FF8A80143FD
a unicode character, xrefs: 00007FF8A80143EF

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: a unicode character$argument 1$decimal
API String ID: 3876575403-2474051849
Opcode ID: d3484de5ee44d7a33ec5e53d5364025946576caca118cb4f9bd9e3e7fb1b6d42
Instruction ID: 75053281df7b667c51b26e8e8ad0c7b942984d0b88eee45ba54eb7621e7cd184
Opcode Fuzzy Hash: d3484de5ee44d7a33ec5e53d5364025946576caca118cb4f9bd9e3e7fb1b6d42
Instruction Fuzzy Hash: C9119132B0AA42E6EE509F42E4802A96361FB44BD4F584036DE0D477E5CF3DD5A6C354

Function 00007FF8A8014CA4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FF8A8014CE3
_PyArg_BadArgument.PYTHON312 ref: 00007FF8A8014D18

Strings

argument 1, xrefs: 00007FF8A8014D11
numeric, xrefs: 00007FF8A8014CD3, 00007FF8A8014D0A
a unicode character, xrefs: 00007FF8A8014D03

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: a unicode character$argument 1$numeric
API String ID: 3876575403-2385192657
Opcode ID: 047d09c28d14a3fb074898e0464a76a5d15e70b5d1db224d2900275fff384a43
Instruction ID: be427e8b2bacf03f26cb3189d0e605783d5fe2d6f356656e60b17681f82a6f7f
Opcode Fuzzy Hash: 047d09c28d14a3fb074898e0464a76a5d15e70b5d1db224d2900275fff384a43
Instruction Fuzzy Hash: 1F119E31B0AE42E5EE509B42E4402A96361FB44FE4F584036DE1D477E5CF3DE5A6C318

Function 00007FF8A82B2554 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A82D4DEC
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82D4E04
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A82D4E16

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A82D4DFD
SSL_write_early_data, xrefs: 00007FF8A82D4DF6

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_write_early_data
API String ID: 1552677711-3084438645
Opcode ID: 1dab58dc8e0839f33359c121125ef13997fa5df5ab094a12696ea5dc9b67ca7b
Instruction ID: bd61646a5ac599234879332bfa5d3e8319e1ba760a621b4beb09a47fce702c95
Opcode Fuzzy Hash: 1dab58dc8e0839f33359c121125ef13997fa5df5ab094a12696ea5dc9b67ca7b
Instruction Fuzzy Hash: 1F01FC22B0AA55A6F700DB41F8406FA6B20FB44BD4F984031EF4C03769DF7CD1528754

Function 00007FF8A8014A6C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON312 ref: 00007FF8A8014A9C
PyErr_Occurred.PYTHON312 ref: 00007FF8A8014ACB

Strings

argument, xrefs: 00007FF8A8014A8E
mirrored, xrefs: 00007FF8A8014A95
a unicode character, xrefs: 00007FF8A8014A87

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Arg_ArgumentErr_Occurred
String ID: a unicode character$argument$mirrored
API String ID: 3979797681-4001128513
Opcode ID: 90d5ae0072a7ca6e879d97d47db35ea336886febc9b0d1b251bdc56bef49b412
Instruction ID: 50ab740f342e7234432771d1d127c9b5c59c02a930cdec751ba03db79bf20b5b
Opcode Fuzzy Hash: 90d5ae0072a7ca6e879d97d47db35ea336886febc9b0d1b251bdc56bef49b412
Instruction Fuzzy Hash: A801DF20E0AA43E6FE648B11A8400B823A1FF497E4F810235D50D872E0DF3CE5B4C32C

Function 00007FF8A80142A4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON312 ref: 00007FF8A80142D4
PyErr_Occurred.PYTHON312 ref: 00007FF8A8014303

Strings

argument, xrefs: 00007FF8A80142C6
combining, xrefs: 00007FF8A80142CD
a unicode character, xrefs: 00007FF8A80142BF

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Arg_ArgumentErr_Occurred
String ID: a unicode character$argument$combining
API String ID: 3979797681-4202047184
Opcode ID: f57a56bca3f03315399802cbb188705c8f0221a3905f8c719d86b24713be5e96
Instruction ID: 6f97e1130af25ef31ab2c442c155f497e1f04c11786fe6c380e9956944f6bda8
Opcode Fuzzy Hash: f57a56bca3f03315399802cbb188705c8f0221a3905f8c719d86b24713be5e96
Instruction Fuzzy Hash: D1018F61E0AE43E2EE649B51A8411B823A1FF097E4F800639D50D872E4CF3CE5A5C368

Function 00007FF8A8012610 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON312(?,?,00000000,00007FF8A801254A), ref: 00007FF8A801261B
PyCapsule_New.PYTHON312(?,?,00000000,00007FF8A801254A), ref: 00007FF8A8012658
PyErr_NoMemory.PYTHON312(?,?,00000000,00007FF8A801254A), ref: 00007FF8A8013FB8
PyMem_Free.PYTHON312(?,?,00000000,00007FF8A801254A), ref: 00007FF8A8013FC8

Strings

unicodedata._ucnhash_CAPI, xrefs: 00007FF8A801264D

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Mem_$Capsule_Err_FreeMallocMemory
String ID: unicodedata._ucnhash_CAPI
API String ID: 3673501854-3989975041
Opcode ID: 04962b3129ec8039d4574c2b15526bc82bf072c2335504b47079f601afa57e40
Instruction ID: 4a4383905a435b1c50925f5ed6a84083b364e74bf79cedfb8add78064ff93f8b
Opcode Fuzzy Hash: 04962b3129ec8039d4574c2b15526bc82bf072c2335504b47079f601afa57e40
Instruction Fuzzy Hash: 5FF01930A2BB46E9EF168B11A854178A3A4FF487E5F481435D84E4B3E4EF3CE064C328

Function 00007FF7B3C69A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7B3C69AAD
GetProcAddress.KERNEL32 ref: 00007FF7B3C69AC3
FreeLibrary.KERNEL32 ref: 00007FF7B3C69AEA

Strings

CorExitProcess, xrefs: 00007FF7B3C69ABC
mscoree.dll, xrefs: 00007FF7B3C69AA4

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: c01c6fcc90ef4c949bffe6cae5fe0a8a1ddcdc1995f5d4f508416bba7752aa3a
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: 25F0686170970681EA50AB98E84C376A360AF56761F940235DB6E565ECDF3CD1C5D320

Function 00007FF8A82CED82 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A82CED89
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82CEDA1
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A82CEDB3

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A82CED9A
SSL_check_private_key, xrefs: 00007FF8A82CED8E

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_check_private_key
API String ID: 1552677711-2796319112
Opcode ID: 6db94ea9f7a0a5273a9064cd9723a29928c20aeccac15a69c6468e03f7ce0fc3
Instruction ID: 9ec8ed62ccb2e9e9c70ba8d61b57ecdffb781d09b486dcef74565c050ac99d9d
Opcode Fuzzy Hash: 6db94ea9f7a0a5273a9064cd9723a29928c20aeccac15a69c6468e03f7ce0fc3
Instruction Fuzzy Hash: 33E01244B1FA8627FB90F770C851AE92911EB91390FC80075E31907AA69F2CD5599375

Function 00007FF8A82CED01 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 12COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A82CED01
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82CED1A
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A82CED2C

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A82CED13
SSL_check_private_key, xrefs: 00007FF8A82CED07

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_check_private_key
API String ID: 1552677711-2796319112
Opcode ID: f01a1e306aeb81aaa1ea29a2ccdcb3320a18adca826b765dcde848bbb51b37d3
Instruction ID: 7844e4e2b70b958fabd1c43bfcd77d4ed81fd437a63a11ed075249381d94a561
Opcode Fuzzy Hash: f01a1e306aeb81aaa1ea29a2ccdcb3320a18adca826b765dcde848bbb51b37d3
Instruction Fuzzy Hash: AED0C754A1AE4673FB40A360C812AE51511EBD5380FCC0075D71C469E2DF3CD5565664

Function 00007FF8A81CEDE0 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 390COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A81CEE86

Strings

vtable constructor did not declare schema: %s, xrefs: 00007FF8A81CF138
hidden, xrefs: 00007FF8A81CF27D
vtable constructor called recursively: %s, xrefs: 00007FF8A81CEFB2
vtable constructor failed: %s, xrefs: 00007FF8A81CEFF9

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: hidden$vtable constructor called recursively: %s$vtable constructor did not declare schema: %s$vtable constructor failed: %s
API String ID: 3510742995-1299490920
Opcode ID: e7995e4d232848af3e6e513670ff4108c02378d202f0f0a1406e83ecbe55202c
Instruction ID: 488d1f5f98a0bca87a08ee1db5c2413ab4b142a0e5ab7ef6ad58b4f618374965
Opcode Fuzzy Hash: e7995e4d232848af3e6e513670ff4108c02378d202f0f0a1406e83ecbe55202c
Instruction Fuzzy Hash: C102CDB2A0AB82A2EB528B11E44437A77A1FB84BD8F444236DF5D07794DF7CE441C368

Function 00007FF8A815C000 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 366COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A815C14D
memcpy.VCRUNTIME140 ref: 00007FF8A815C2A7

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A815C0F3, 00007FF8A815C23A
%s at line %d of [%.10s], xrefs: 00007FF8A815C10C, 00007FF8A815C253
database corruption, xrefs: 00007FF8A815C100, 00007FF8A815C247

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3510742995-3727861699
Opcode ID: 817f07965b872973eaac22bb409c9f214df0c11972e927506548e115749c78ef
Instruction ID: 3c2c8f2aff7e12167f78b773e42ce8cdc95f1357c3e2b42dc6c38b1a73d40b7b
Opcode Fuzzy Hash: 817f07965b872973eaac22bb409c9f214df0c11972e927506548e115749c78ef
Instruction Fuzzy Hash: 99F1A97260AB8196DB95CF65E0407AE77A0FB84BC4F10A036EE8E43B95DF39D885C714

Function 00007FF8A8157970 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 311COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8157A8A
memset.VCRUNTIME140 ref: 00007FF8A8157C1D

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A8157DBF
%s at line %d of [%.10s], xrefs: 00007FF8A8157DD8
database corruption, xrefs: 00007FF8A8157DCC

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2221118986-3727861699
Opcode ID: e219ea214ae72893cfc9b9709a1bb5107c457c673b9734759cd4db992959291e
Instruction ID: 69fccda09257ed52b0629ff5a9e77d2b7378abfa903169521bd2ddaf4960290b
Opcode Fuzzy Hash: e219ea214ae72893cfc9b9709a1bb5107c457c673b9734759cd4db992959291e
Instruction Fuzzy Hash: 42D1DD7260AB8696DB6ACF25D1056A977E4FB88BC8F059432CF4D4B794EF38D842C310

Function 00007FF8A81B9750 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 288COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00000000,?,00000003,00000000,00007FF8A81B9F87,?,00000007,?), ref: 00007FF8A81B97D0
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00000000,?,00000003,00000000,00007FF8A81B9F87,?,00000007,?), ref: 00007FF8A81B9917

Strings

%.*z:%u, xrefs: 00007FF8A81B99E6
rowid, xrefs: 00007FF8A81B98A8
column%d, xrefs: 00007FF8A81B9925

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpymemset
String ID: %.*z:%u$column%d$rowid
API String ID: 1297977491-2903559916
Opcode ID: 54aec74016a1534b94afb4335c68ab95369ae6dc0b9c661cadfafce1b6c1824d
Instruction ID: 32a6b648c30353c63a94dbe7aff6805acdff9ba40fc1fb6ebdaa327d180ff060
Opcode Fuzzy Hash: 54aec74016a1534b94afb4335c68ab95369ae6dc0b9c661cadfafce1b6c1824d
Instruction Fuzzy Hash: ECB1D162A0B786A9EA679B1594483B96BA8FF41BC4F494135DE4D073D5FF3CE402C328

Function 00007FF8A817D3D0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FF8A8177847), ref: 00007FF8A817D52A
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FF8A8177847), ref: 00007FF8A817D554
memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FF8A8177847), ref: 00007FF8A817D572
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FF8A8177847), ref: 00007FF8A817D5A7

Strings

H, xrefs: 00007FF8A817D53E

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy$memset
String ID: H
API String ID: 438689982-2852464175
Opcode ID: cfbeda1bf99951151eff030447c4d7a4d5e89bf1fbf00df94b65fd72b816f457
Instruction ID: f073bc078c78b151badeff3427bebed566d7bf7301055460144b9bc304f112a3
Opcode Fuzzy Hash: cfbeda1bf99951151eff030447c4d7a4d5e89bf1fbf00df94b65fd72b816f457
Instruction Fuzzy Hash: 0291B37261A68996EB658E15E4407796BA1FB84BD4F144A38EF5E07BC8CF3CE440CF18

Function 00007FF8A815B070 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 197COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A81598B0: memcpy.VCRUNTIME140 ref: 00007FF8A815991D
Part of subcall function 00007FF8A81598B0: memcpy.VCRUNTIME140 ref: 00007FF8A8159944

memcpy.VCRUNTIME140 ref: 00007FF8A815B2F3
memcpy.VCRUNTIME140 ref: 00007FF8A815B309

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A815B117
%s at line %d of [%.10s], xrefs: 00007FF8A815B137
database corruption, xrefs: 00007FF8A815B130

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3510742995-3727861699
Opcode ID: d722efc5368d3c99c61d6ff00f4d07227d654d843d12c76e9b689ca2d86c9870
Instruction ID: 82b79134e8988f70be5cd3877f88b62bb377132e2bc87282b4dc186cb6190c22
Opcode Fuzzy Hash: d722efc5368d3c99c61d6ff00f4d07227d654d843d12c76e9b689ca2d86c9870
Instruction Fuzzy Hash: E3810F3270A682ABE7698F25E4847AE77A1FB447C4F408032EB4E43795DF38E445C724

Function 00007FF8A81589A0 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 192COMMON

Download Yara Rule

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A8158A4C
%s at line %d of [%.10s], xrefs: 00007FF8A8158A66
database corruption, xrefs: 00007FF8A8158A5F

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 0-3727861699
Opcode ID: 5e912ee1f7678e77240253c0303bb73c2f618f6b1c89537da6c189cf6ac1dde9
Instruction ID: ee16a691787fea9a10afec17f3eac2cf4d892dc4fa26e1680c243c5a85aaf1dd
Opcode Fuzzy Hash: 5e912ee1f7678e77240253c0303bb73c2f618f6b1c89537da6c189cf6ac1dde9
Instruction Fuzzy Hash: 4381296260A2C1AAD76A8B25C1806BF7BE0FB407C5F044132DF8E47695DF3CE4A5C764

Function 00007FF8A81CD690 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 163stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000,00000001,00007FF8A81CD93A,?,?,?,00007FF8A81CDCFB), ref: 00007FF8A81CD7F9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000,00000001,00007FF8A81CD93A,?,?,?,00007FF8A81CDCFB), ref: 00007FF8A81CD813
memcpy.VCRUNTIME140(?,?,?,?,?,?,00000000,00000001,00007FF8A81CD93A,?,?,?,00007FF8A81CDCFB), ref: 00007FF8A81CD8A7

Strings

INS, xrefs: 00007FF8A81CD809
CRE, xrefs: 00007FF8A81CD7EF

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: strncmp$memcpy
String ID: CRE$INS
API String ID: 2549481713-4116259516
Opcode ID: 323af4d7b01ca3ab035970fea9524ec967544429bf44c227169c1e77e0f9c29a
Instruction ID: bae4f8a3feab74b3586236a8a10cbe8481b56b3a9f02f926a8f1fc6b7ee1c6fd
Opcode Fuzzy Hash: 323af4d7b01ca3ab035970fea9524ec967544429bf44c227169c1e77e0f9c29a
Instruction Fuzzy Hash: 1851BD65B0BB42A1FA629B2294502796B91FF80FC8F584935CE4D87789DF3CE811C36C

Function 00007FF8A8158CA0 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A8158D27
memmove.VCRUNTIME140 ref: 00007FF8A8158E05

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A8158EA9
%s at line %d of [%.10s], xrefs: 00007FF8A8158EC1
database corruption, xrefs: 00007FF8A8158EB5

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpymemmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 167125708-3727861699
Opcode ID: a5e659041314e3c25e76cf73738960ed205ebc87af3a3a0fcf928fdaf9d09721
Instruction ID: b4c76489216b10f07ea3109869acf6f38d00264963a39aac09b0ba75ef74fa22
Opcode Fuzzy Hash: a5e659041314e3c25e76cf73738960ed205ebc87af3a3a0fcf928fdaf9d09721
Instruction Fuzzy Hash: 5851ED72709BC0D6CB158F19E484AAEBBA5F758BC4F15903AEA8E03758DB3CD055C724

Function 00007FF8A813D9E0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A813DA23
memcpy.VCRUNTIME140 ref: 00007FF8A813DA4C
memset.VCRUNTIME140 ref: 00007FF8A813DB63

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FF8A813DB38
winRead, xrefs: 00007FF8A813DAF7

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy$memset
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 438689982-1843600136
Opcode ID: 66d7818fc9c6dce62004362554e4c0cfd5c82727d3bea9d87ae7196a0384542c
Instruction ID: 8b6302ba7768b90cdbfb8e0c2074b0abdce3bb7e796f0306b446939ff8df9b5a
Opcode Fuzzy Hash: 66d7818fc9c6dce62004362554e4c0cfd5c82727d3bea9d87ae7196a0384542c
Instruction Fuzzy Hash: DB415732B0EA86A6E7608F25E9404B97BA5FF547C0F044432EA4D43798DF3CE446C758

Function 00007FF7B3C79368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7B3C79390
_set_statfp.LIBCMT ref: 00007FF7B3C793AB
_set_statfp.LIBCMT ref: 00007FF7B3C793C7
_set_statfp.LIBCMT ref: 00007FF7B3C79403

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 7e1cbec7e533feb0274d7040c3cce9be04d8b25e07edd9180ee80c54c9af6e4c
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: D9116332D58A0281F6D471EDE49A3799051AF7B375F840634EF6F362DE8E6CA8C14130

Function 00007FF7B3C6B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7B3C6A5A3,?,?,00000000,00007FF7B3C6A83E,?,?,?,?,?,00007FF7B3C6A7CA), ref: 00007FF7B3C6B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C6A5A3,?,?,00000000,00007FF7B3C6A83E,?,?,?,?,?,00007FF7B3C6A7CA), ref: 00007FF7B3C6B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C6A5A3,?,?,00000000,00007FF7B3C6A83E,?,?,?,?,?,00007FF7B3C6A7CA), ref: 00007FF7B3C6B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C6A5A3,?,?,00000000,00007FF7B3C6A83E,?,?,?,?,?,00007FF7B3C6A7CA), ref: 00007FF7B3C6B407
FlsSetValue.KERNEL32(?,?,?,00007FF7B3C6A5A3,?,?,00000000,00007FF7B3C6A83E,?,?,?,?,?,00007FF7B3C6A7CA), ref: 00007FF7B3C6B418

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
Instruction ID: 7b264e1aea697005ab8db6ee4820bbcdb21837caf56e0d3494a22ffa50c5979b
Opcode Fuzzy Hash: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
Instruction Fuzzy Hash: 5B113020F08A4242FAD8B7EE5559179D2415F667B0FD84734DB2DA76DEDE2CE4C14220

Function 00007FF7B3C6B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7B3C6B235
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B254
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B27C
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B28D
FlsSetValue.KERNEL32 ref: 00007FF7B3C6B29E

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
Instruction ID: 3aa0c9cb80d076d2cd37a4ba2c3b5618ef16a5fd79edd66d556817633b589204
Opcode Fuzzy Hash: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
Instruction Fuzzy Hash: 4111F560A0860741FAE872FE445917D93824F67320F944734DB2EEB6CADE2CB4C042B1

Function 00007FF7B3C65FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C65FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C66106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C661BC

Strings

verbose, xrefs: 00007FF7B3C65FB0

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 8fe9f5f23edaabad3bfce04fe21e63f5255cc391dd80b8094a8b479fe883020e
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 2A910632A08A4651F7A0AEA8D45837DB794AB63B54FC44131DB9EE33C9DF3DE4958320

Function 00007FF7B3C6FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C6FEA7

Part of subcall function 00007FF7B3C67A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C67A59

Strings

UTF-8, xrefs: 00007FF7B3C6FE26
ccs, xrefs: 00007FF7B3C6FDE2
UTF-16LEUNICODE, xrefs: 00007FF7B3C6FE45

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: c94f6b54a7b53d696bb46c843d59797804344e27ea2c114fcc8ae99a5d4fa071
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: A9818376E0814285E7E57EAD8158278BBA0AB33B44FD54035CB09E72CEDB2DB9819321

Function 00007FF7B3C5D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7B3C5D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7B3C5D70A
RtlUnwindEx.KERNEL32 ref: 00007FF7B3C5D764

Strings

csm, xrefs: 00007FF7B3C5D6F1

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 489a86170379063bf3cd3e106093b1a4c86f3a081757d0b5a27455536ac1790d
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: CC51B032A197028ADB94AB59D40DA38B391EB65BC8F924132DB4E577CCDF3CE885C750

Function 00007FF7B3C5F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7B3C5F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7B3C5F398

Strings

csm, xrefs: 00007FF7B3C5F2D2
csm, xrefs: 00007FF7B3C5F3EA

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 7bffd6060d38a52a532ac091aaa3aa30a1cd673359b01c9202529d6605c98218
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: 5B518232608642C6EBA8ABA9914927CB790FB66B85F954137DF4C53BC9CF3CE490C711

Function 00007FF7B3C5EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7B3C5EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7B3C5EF83

Strings

MOC, xrefs: 00007FF7B3C5EF4B
RCC, xrefs: 00007FF7B3C5EF53

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: c698270e4f2c1c2d16c11559e46e39b959fbb80617f897b9fa8aed4c0ea4d2dd
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 8961A032908BC185D7A4AB69E4453BAB7A0FB96784F444226EF9C53B99CF7CD0D0CB10

Function 00007FF8A8310929 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A8310B24
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8310B3C

Strings

ossl_statem_client13_write_transition, xrefs: 00007FF8A8310B2E
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A8310B35

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$ossl_statem_client13_write_transition
API String ID: 193678381-2379272181
Opcode ID: 6b6ed7f3a678ecc75a7d747022675d142700c22842b4c3ad729f0346f2aae6d1
Instruction ID: 1cc8a499d3556f3a98d9ec73332060b133ef96381c518e4ec06622dd263a2a8f
Opcode Fuzzy Hash: 6b6ed7f3a678ecc75a7d747022675d142700c22842b4c3ad729f0346f2aae6d1
Instruction Fuzzy Hash: C9F05910F0B84266F700A754E894BF91740DF483C8F58C030E90D87BA6EF2CE2438718

Function 00007FF7B3C57E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7B3C5352C,?,00000000,00007FF7B3C53F1B), ref: 00007FF7B3C57F32

Strings

\, xrefs: 00007FF7B3C57E97
%.*s, xrefs: 00007FF7B3C57EEB
%s%c, xrefs: 00007FF7B3C57EA4

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction ID: ac114a7a6db2290fa00442cfb4c149d37fd76c129da2900370d61450910a89a2
Opcode Fuzzy Hash: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction Fuzzy Hash: F8310921619AC145EAA1EB58E8193BAA254EB95BE0F900232EF6D537CDDF2CD2858710

Function 00007FF7B3C52810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7B3C528EA

Strings

[PYI-%d:%ls] , xrefs: 00007FF7B3C52868
Error, xrefs: 00007FF7B3C528DD
ERROR, xrefs: 00007FF7B3C5286F

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: c67b61c8ccc7c4d7f779b959cfd663679744c92290deb88d38e644b05b02d272
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: A121D362708B4181E750AB98F4497EAB3A0EB99784F804136EF8D6369ADF3CD285C750

Function 00007FF8A8011ED0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312(?,?,?,?,?,00007FF8A8011EBC), ref: 00007FF8A8013C1F

Part of subcall function 00007FF8A8011FB0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8011FE8
Part of subcall function 00007FF8A8011FB0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8012006

PyErr_Format.PYTHON312 ref: 00007FF8A8011F33

Strings

name too long, xrefs: 00007FF8A8013C15
undefined character name '%s', xrefs: 00007FF8A8011F26

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Err_strncmp$FormatString
String ID: name too long$undefined character name '%s'
API String ID: 3882229318-4056717002
Opcode ID: 1035d3c545dcad7f3fc1fcdb04c9696ab0948ab795443172b9eb40205ee2c5c7
Instruction ID: 71d70a9202d87c7f416791ee3d000c463ef9e0552ea916ec42a7c45d01db9905
Opcode Fuzzy Hash: 1035d3c545dcad7f3fc1fcdb04c9696ab0948ab795443172b9eb40205ee2c5c7
Instruction Fuzzy Hash: 1B115276B1A947E5EF408B14E4842B46361FB987E8F800531CA4D8B2E0DF7DD15AC768

Function 00007FF8A82B1D39 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A8326962
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A832697A

Strings

tls_construct_cert_status_body, xrefs: 00007FF8A8326967
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8A8326973

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$tls_construct_cert_status_body
API String ID: 193678381-3528029177
Opcode ID: 99f175a475ec9a6eeaaffc58756a06ec8e5023f8386e2d2f363bd87b13919105
Instruction ID: 8e38884fe7e2ab000583082d74fa4eefeec2703bdec8877774bd754991f13065
Opcode Fuzzy Hash: 99f175a475ec9a6eeaaffc58756a06ec8e5023f8386e2d2f363bd87b13919105
Instruction Fuzzy Hash: 7001A721B0EA8260FB90A722E9817F90610EF59BC4F4C4031ED4D4BBCAEF1CD5414764

Function 00007FF8A82B2568 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A8310DAD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8310DC5

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A8310DBE
ossl_statem_client_construct_message, xrefs: 00007FF8A8310DB2

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$ossl_statem_client_construct_message
API String ID: 193678381-1769619531
Opcode ID: 232cff527c98032cecb954563da7b1d9aa9a6d5cfcb7ad24c176298f0700d633
Instruction ID: 5c749c4f14ac8b174626a7d13b41646b69f74b5cccbdef522832f67b209507d3
Opcode Fuzzy Hash: 232cff527c98032cecb954563da7b1d9aa9a6d5cfcb7ad24c176298f0700d633
Instruction Fuzzy Hash: 4FF02421F4B94262FB40A364D851BFD2640EF457C4F688131EA0D837D6EF2DE1438728

Function 00007FF8A814F650 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A814BB70: RaiseException.KERNEL32 ref: 00007FF8A814BBC5

memcmp.VCRUNTIME140 ref: 00007FF8A814F6A6

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A814F863
%s at line %d of [%.10s], xrefs: 00007FF8A814F87C
database corruption, xrefs: 00007FF8A814F870

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: ExceptionRaisememcmp
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2159421160-3727861699
Opcode ID: 5510feb14dea88ae92a77c34ee5a39bd9dff1919bc737fe2358dd9b970a8dbf4
Instruction ID: dbe91149abb5e63f04cf320a4ff9532d6209e62891bed64d5529009553ca72d7
Opcode Fuzzy Hash: 5510feb14dea88ae92a77c34ee5a39bd9dff1919bc737fe2358dd9b970a8dbf4
Instruction Fuzzy Hash: 03F169A2B0A742EBE725CBA5C5506AD37A1FB48788F104035DE0DABB85DF38E815C794

Function 00007FF8A81940F0 Relevance: 6.3, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8194150
memcpy.VCRUNTIME140 ref: 00007FF8A8194165
memcpy.VCRUNTIME140 ref: 00007FF8A8194189
memcpy.VCRUNTIME140 ref: 00007FF8A81941A8
memcpy.VCRUNTIME140 ref: 00007FF8A81941C0

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: b93e7d24146e94e90c05e856a74659a5816adcbd1dcfc72995cc6fe0d7043182
Instruction ID: 68d3b4507766d855f40e2af106f606fafd80b8ced5e9ca7da32f1c52bd76dba2
Opcode Fuzzy Hash: b93e7d24146e94e90c05e856a74659a5816adcbd1dcfc72995cc6fe0d7043182
Instruction Fuzzy Hash: 87219C62B0AB8293DA64AB16B5410BAB3A1FB44BC0F085131DBCE47F5ADF2CF051C714

Function 00007FF7B3C6C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7B3C6C61F
WriteFile.KERNEL32 ref: 00007FF7B3C6C8E7
WriteFile.KERNEL32 ref: 00007FF7B3C6C92D
GetLastError.KERNEL32 ref: 00007FF7B3C6C9E3

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: f3f8f3110ccb5ecca108310074bda3c2f6142132aab5c42c91eaa994bc00359a
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: 08D10572B08A4189E750DFB9D4441AC77B1FB66798B848236DF5DA7BCADE38D086C310

Function 00007FF8A813EC40 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 249COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A813ECCC

Strings

%s-shm, xrefs: 00007FF8A813ECE3
winOpenShm, xrefs: 00007FF8A813EEDA
readonly_shm, xrefs: 00007FF8A813EE6A

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memset
String ID: %s-shm$readonly_shm$winOpenShm
API String ID: 2221118986-2815843928
Opcode ID: b451b3daf032857cef78d805c9d3a8f66ac8fec50fade8d883b78bd73538fe5d
Instruction ID: 888eeb576f8b4294a72674a709cd46f7885272d4466af10c87bcada0852b817e
Opcode Fuzzy Hash: b451b3daf032857cef78d805c9d3a8f66ac8fec50fade8d883b78bd73538fe5d
Instruction Fuzzy Hash: 09C14F21A0BF42A6FAA6AF21A454A7937A0FF44BD0F444136DD5E42B94DF3CE845C328

Function 00007FF8A81C85A0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 239COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FF8A81C8A6F), ref: 00007FF8A81C8739
memcpy.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FF8A81C8A6F), ref: 00007FF8A81C87BB
memcpy.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FF8A81C8A6F), ref: 00007FF8A81C88AD

Strings

RETURNING may not use "TABLE.*" wildcards, xrefs: 00007FF8A81C8621

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: RETURNING may not use "TABLE.*" wildcards
API String ID: 3510742995-2313493979
Opcode ID: 0288751f268e253f0b5d943a861ab99312bd63e3f322591f5a0f5aea74af32d9
Instruction ID: 2c2a388d40e1b26f04a6426ae7e80ed91f75cda78618e4b623daf77212ecc522
Opcode Fuzzy Hash: 0288751f268e253f0b5d943a861ab99312bd63e3f322591f5a0f5aea74af32d9
Instruction Fuzzy Hash: AAB1B062A09B81A6E761CF1694802A977A1FB44FE4F058335DF6D07BD5EF38E0A1C318

Function 00007FF7B3C6CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B3C6CF4B), ref: 00007FF7B3C6D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B3C6CF4B), ref: 00007FF7B3C6D107

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 56dfebb5ca6322fb04c47076f0f714e5a3dcc9659065a7a72cffe884ec5e9ff1
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: E691F622E1865185F790AFAD844827DA7A0BB66B98F944135DF0EB36C9CF39D4C6D320

Function 00007FF8A81D0410 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 216COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A81D057F

Part of subcall function 00007FF8A8138BF0: memcpy.VCRUNTIME140(?,?,?,00007FF8A8138606), ref: 00007FF8A8138C21

Strings

<expr>, xrefs: 00007FF8A81D0513
AND , xrefs: 00007FF8A81D044F, 00007FF8A81D046A
rowid, xrefs: 00007FF8A81D054E

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: AND $<expr>$rowid
API String ID: 3510742995-4041574714
Opcode ID: bd8a3048d69df6166b223ea7dc75565c0762b21f5b460e88b0cbb52fce417d1a
Instruction ID: cc99ee65987a0ca83264dcd5dec6d63841f6f5c30b2a11e30600dbb16ecfd85e
Opcode Fuzzy Hash: bd8a3048d69df6166b223ea7dc75565c0762b21f5b460e88b0cbb52fce417d1a
Instruction Fuzzy Hash: D9A1AB72A0A642EAEB09CF19D0906787761FB55BC8F544035DE0E47398CF3DE895CBA8

Function 00007FF8A81B93F0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 198COMMON

Download Yara Rule

Strings

%s.%s, xrefs: 00007FF8A81B956E
rowid, xrefs: 00007FF8A81B954E
column%d, xrefs: 00007FF8A81B95F8

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID: %s.%s$column%d$rowid
API String ID: 0-1505470444
Opcode ID: ce9811c683529395846280cdd6f3ca33b5e0997b8693e991c0a95600bcbb4431
Instruction ID: 11f3030bd34722d2d801bfaee5a7b665600619dd4a9c13b5bd2d2a13c1cc7a60
Opcode Fuzzy Hash: ce9811c683529395846280cdd6f3ca33b5e0997b8693e991c0a95600bcbb4431
Instruction Fuzzy Hash: 9291AD32A0AB8199EA61CB15E4483AA67A8FB45BF4F544336DEAD477D4EF3CD402C314

Function 00007FF8A8193E60 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A819408E

Strings

, xrefs: 00007FF8A8193F3D
, , xrefs: 00007FF8A8193F1E
CREATE TABLE , xrefs: 00007FF8A8193F7F

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: $, $CREATE TABLE
API String ID: 3510742995-3459038510
Opcode ID: 832b16504b5a9b49fb980fcc5d385331d822df2d8622951f50e03f146071ea99
Instruction ID: 4bd9a65ba18059d7523682b2584b7c7477e7409c827f6dc2b48c81520d1b4cb5
Opcode Fuzzy Hash: 832b16504b5a9b49fb980fcc5d385331d822df2d8622951f50e03f146071ea99
Instruction Fuzzy Hash: 89612962B0A98196DB268F19E4402B9B7A2FB40BE4F484335DE5D437D5DF3DD446C314

Function 00007FF8A814A0D0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 174COMMON

Download Yara Rule

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A814A0F2, 00007FF8A814A248
%s at line %d of [%.10s], xrefs: 00007FF8A814A112, 00007FF8A814A268
database corruption, xrefs: 00007FF8A814A10B, 00007FF8A814A261

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 0-3727861699
Opcode ID: 284fb38653da876aa8efdd9a6ba98a4ebc5b2a4409a3f47e7cdb6a524325cf1d
Instruction ID: e62718534a0bc51ea9efd81c8bbe31331f83fb15bbe32b2034dab480f897fd77
Opcode Fuzzy Hash: 284fb38653da876aa8efdd9a6ba98a4ebc5b2a4409a3f47e7cdb6a524325cf1d
Instruction Fuzzy Hash: 9A717EA2A0AA42E2FB669B15E44077973A1FB44BC4F564035CE4E47795DF3DE8C1C328

Function 00007FF8A8011FB0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8011FE8
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8012006

Strings

CJK UNIFIED IDEOGRAPH-, xrefs: 00007FF8A8011FFC
HANGUL SYLLABLE , xrefs: 00007FF8A8011FD5

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: strncmp
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 1114863663-87138338
Opcode ID: 8c364d9f7697f15a55bc755bfe662b8d9c35c3fd34f27cade82d87210dead623
Instruction ID: 83ce44d02df734e45e951ab92879acb257e28eaafd40f2bb1652c9f880c982f2
Opcode Fuzzy Hash: 8c364d9f7697f15a55bc755bfe662b8d9c35c3fd34f27cade82d87210dead623
Instruction Fuzzy Hash: AA612832B1A642DAEA61CA15A80067EB252FB84FE0F458335EE5D47BC9DF3CE461C714

Function 00007FF7B3C6F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7B3C6FA7C
_get_daylight.LIBCMT ref: 00007FF7B3C6FA8D
_get_daylight.LIBCMT ref: 00007FF7B3C6FA9E
_isindst.LIBCMT ref: 00007FF7B3C6FB69

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 8a3a5e73cbe1d7f749e815bc29cf23bfed4356affbae38564508d71a3fc01c52
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 25514A72F0421186FB54EFAC98592BCA761AF61358F901239DF1DA3ADDDF38A482C710

Function 00007FF8A816C5E7 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A816C72D
memcpy.VCRUNTIME140 ref: 00007FF8A816C746

Strings

out of memory, xrefs: 00007FF8A8172478
string or blob too big, xrefs: 00007FF8A8172103

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: out of memory$string or blob too big
API String ID: 3510742995-2410398255
Opcode ID: 32c2ae49c0d43b0bf73bf14441e4c9b52f205afacfc25aad9bb6812841d0f57a
Instruction ID: 9c5e4111ef28c5b47cabe13ac41a0d91c72d0d99098fca6d4af0f92b78591311
Opcode Fuzzy Hash: 32c2ae49c0d43b0bf73bf14441e4c9b52f205afacfc25aad9bb6812841d0f57a
Instruction Fuzzy Hash: A8610362B0A692A2E712DB26E14027E6760FF45BD4F104036EF8D17B99DF3CE452C728

Function 00007FF8A814A360 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A814A488

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A814A542
%s at line %d of [%.10s], xrefs: 00007FF8A814A55B
database corruption, xrefs: 00007FF8A814A54F

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2221118986-3727861699
Opcode ID: 1aaf92a3dee10489ca127c91049f726b6372f6afbca9bbcc73f9ce4721a391c9
Instruction ID: 870c7755bce421f52fb896045246991837d7dfef7a01b5cc75858976aedab299
Opcode Fuzzy Hash: 1aaf92a3dee10489ca127c91049f726b6372f6afbca9bbcc73f9ce4721a391c9
Instruction Fuzzy Hash: B1518A62A0AB81E6EB55CB26E5447AE73A4FB48BC4F194032DE4D43794EF38E491C358

Function 00007FF8A8138417 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A81384C8
memcpy.VCRUNTIME140 ref: 00007FF8A813854E

Strings

(subquery-%u), xrefs: 00007FF8A8138570
(join-%u), xrefs: 00007FF8A8138559

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: (join-%u)$(subquery-%u)
API String ID: 3510742995-2916047017
Opcode ID: e4b271abe33ea453b0af829f0d0b3c64b2499140cc847aae9644bee38be7c82c
Instruction ID: 7b59df810750343e7e46f72179c5555d6ee407dcb233827f4313b4475523b735
Opcode Fuzzy Hash: e4b271abe33ea453b0af829f0d0b3c64b2499140cc847aae9644bee38be7c82c
Instruction Fuzzy Hash: 73510476B1A642A2EBA2CB25D04473923A1FB04BE0F564631DA3E437C8DF2CE451C768

Function 00007FF8A8158EF0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A8159012

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A8159078
%s at line %d of [%.10s], xrefs: 00007FF8A8159091
database corruption, xrefs: 00007FF8A8159085

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2162964266-3727861699
Opcode ID: d6626209ff5963ca4a15e42e4622f64455280571ca08852fb66255ebaf8cff30
Instruction ID: 37fabb91762bd2aa452008cdc8eb09e6276c7940d6328cb9f94d764f75bc018a
Opcode Fuzzy Hash: d6626209ff5963ca4a15e42e4622f64455280571ca08852fb66255ebaf8cff30
Instruction Fuzzy Hash: 7C51783260ABC0E6EB258F15F4002AAB7A5FB88BC4F544032DA8D43B58DF3CD495C710

Function 00007FF7B3C6577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7B3C657AF
GetFileInformationByHandle.KERNEL32 ref: 00007FF7B3C65811
GetLastError.KERNEL32 ref: 00007FF7B3C658A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B3C656B4), ref: 00007FF7B3C658EE

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: d31fd36751b53e10f7519683686ae40593c186350f506316241d97ff8782fe8e
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: 7851A222E0864189F790EFB9D4543BDB7A1AB59B58F605434DF0DA76C8DF38D8818720

Function 00007FF8A815FE60 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A815FF93

Strings

%!.15g, xrefs: 00007FF8A815FFDC
-, xrefs: 00007FF8A815FF77
, xrefs: 00007FF8A815FFB2

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID: $%!.15g$-
API String ID: 3510742995-875264902
Opcode ID: 312380605faac612b932c0e84749a71c5b5db630570bc0cb0ad3afdeeff4af52
Instruction ID: 717438b4e94fec591856e7611b50051acab6fd10941151d38f73741353e171d9
Opcode Fuzzy Hash: 312380605faac612b932c0e84749a71c5b5db630570bc0cb0ad3afdeeff4af52
Instruction Fuzzy Hash: 7C415862E1E78597E715CB2EE0007AA7BA0EB857C0F005136EA8D4778ACB3DD505C750

Function 00007FF8A8158550 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A81585A7
%s at line %d of [%.10s], xrefs: 00007FF8A81585C0
database corruption, xrefs: 00007FF8A81585B4

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 0-3727861699
Opcode ID: 6305e94a9a690e28374634513fa7c07f3dc0461b62686fa81fd07b9bb206b833
Instruction ID: 02c7ab17831dbdd1451993b715ea65e5ecf0c53b169e04c9e8413c12eb5df4d8
Opcode Fuzzy Hash: 6305e94a9a690e28374634513fa7c07f3dc0461b62686fa81fd07b9bb206b833
Instruction Fuzzy Hash: 9A31EE7260A6C19ED309CF3AD49047E7BA1E741B84F044136DF994B399EB3CD565CB60

Function 00007FF8A814C240 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A814C2A7

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FF8A814C342
%s at line %d of [%.10s], xrefs: 00007FF8A814C35B
database corruption, xrefs: 00007FF8A814C34F

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2221118986-3727861699
Opcode ID: d55a6328535592a9e318385a5f1e464099d72822ee4cd89bff26eb268217b2a5
Instruction ID: fb81be0f0078c718c660701f529d60cf081cb67ed555d541db92b61fe2c51d83
Opcode Fuzzy Hash: d55a6328535592a9e318385a5f1e464099d72822ee4cd89bff26eb268217b2a5
Instruction Fuzzy Hash: 9731B17271A68292EB509F59E4506BA77A1FB88BC0F440135EE4E87B98DF3CD542CB14

Function 00007FF7B3C520C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7B3C520F4
SetWindowLongPtrW.USER32 ref: 00007FF7B3C52116
GetWindowLongPtrW.USER32 ref: 00007FF7B3C52140
InvalidateRect.USER32 ref: 00007FF7B3C52160

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: f48bb2874f331df645a5bd0ba5858ccf2dcf1d8cd21cc05ebede968224ae3616
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: B011A921A1C14282F6D4ABEDE54D2BBD291EFA6780FC54031DF4917BDDCD2DD8D58610

Function 00007FF8A7F0836C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8A7F08398
GetCurrentThreadId.KERNEL32 ref: 00007FF8A7F083A6
GetCurrentProcessId.KERNEL32 ref: 00007FF8A7F083B2
QueryPerformanceCounter.KERNEL32 ref: 00007FF8A7F083C2

Memory Dump Source

Source File: 00000002.00000002.2195704227.00007FF8A7DC1000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FF8A7DC0000, based on PE: true

Associated: 00000002.00000002.2195680824.00007FF8A7DC0000.00000002.00000001.01000000.0000002C.sdmpDownload File
Associated: 00000002.00000002.2195968069.00007FF8A7F65000.00000002.00000001.01000000.0000002C.sdmpDownload File
Associated: 00000002.00000002.2195968069.00007FF8A7F9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
Associated: 00000002.00000002.2195968069.00007FF8A7FAD000.00000002.00000001.01000000.0000002C.sdmpDownload File
Associated: 00000002.00000002.2195968069.00007FF8A7FC2000.00000002.00000001.01000000.0000002C.sdmpDownload File
Associated: 00000002.00000002.2196154854.00007FF8A7FE7000.00000004.00000001.01000000.0000002C.sdmpDownload File
Associated: 00000002.00000002.2196180306.00007FF8A7FE8000.00000008.00000001.01000000.0000002C.sdmpDownload File
Associated: 00000002.00000002.2196244583.00007FF8A7FE9000.00000004.00000001.01000000.0000002C.sdmpDownload File
Associated: 00000002.00000002.2196312162.00007FF8A7FEA000.00000008.00000001.01000000.0000002C.sdmpDownload File
Associated: 00000002.00000002.2196338758.00007FF8A7FEF000.00000004.00000001.01000000.0000002C.sdmpDownload File
Associated: 00000002.00000002.2196400111.00007FF8A7FF1000.00000002.00000001.01000000.0000002C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a7dc0000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 577dc08266959ae21a6500757571e48d7ce7a0e6ab2ad46d7b531a59ea63c9c1
Instruction ID: 5b6f418566f502610c4482d2c5830c048ca073a8af48a2265dec728522decc5b
Opcode Fuzzy Hash: 577dc08266959ae21a6500757571e48d7ce7a0e6ab2ad46d7b531a59ea63c9c1
Instruction Fuzzy Hash: C4111826B15B019AEB008F71E8542BC33A4FB19798F442E31DA6D977A4EF7CD2549340

Function 00007FF8A8012BEC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8A8012C18
GetCurrentThreadId.KERNEL32 ref: 00007FF8A8012C26
GetCurrentProcessId.KERNEL32 ref: 00007FF8A8012C32
QueryPerformanceCounter.KERNEL32 ref: 00007FF8A8012C42

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 109ceed06940f0f17d4484f54d46a13cc3e2d9acbfc7514a401e54a12864ff88
Instruction ID: 34c665b5a725f4a08ef5c79d69b2cd532e1736357504891eaa8027e4d6f2db2c
Opcode Fuzzy Hash: 109ceed06940f0f17d4484f54d46a13cc3e2d9acbfc7514a401e54a12864ff88
Instruction Fuzzy Hash: 4F111F36B15F01D9EB00CB60E8542A833A4F719BA8F441931DA5D867A4EF7CD164C354

Function 00007FF8A8262F10 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8A8262F3C
GetCurrentThreadId.KERNEL32 ref: 00007FF8A8262F4A
GetCurrentProcessId.KERNEL32 ref: 00007FF8A8262F56
QueryPerformanceCounter.KERNEL32 ref: 00007FF8A8262F66

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: fc74a681ac9cfba130fc09d6d1be2f184761751582f3a5224d5c822cd04c3667
Instruction ID: 5770706f70da772ec17a48d824de8a652e95f793d3e0d324e7b0cad9e40643f0
Opcode Fuzzy Hash: fc74a681ac9cfba130fc09d6d1be2f184761751582f3a5224d5c822cd04c3667
Instruction Fuzzy Hash: C2115E26B15F029AEB00CF60E8542B833A4FB19B99F441E31DA6D867A8EF7CD164C354

Function 00007FF7B3C5D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7B3C5D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF7B3C5D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF7B3C5D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF7B3C5D066

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 7c744b44f67568ade06d857966a6b2ce1b50fe3516a21d308dcae46b8af41473
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: 06114F22B14B05CAEB409BB4E8482B973A4F76A758F440E31DF1D567A8DF38D1948350

Function 00007FF7B3C75B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B3C71760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C71793

_get_daylight.LIBCMT ref: 00007FF7B3C75C34
_get_daylight.LIBCMT ref: 00007FF7B3C75C45

Strings

?, xrefs: 00007FF7B3C75BC5

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction ID: e6b8a2159582a7ce3beeeace65f4d38f2e54003e56e018d92898c55fd5e38135
Opcode Fuzzy Hash: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction Fuzzy Hash: 10411C12A0824185F7E4ABA99409379E750EBA27E5F944235EF6C17ADDDF3CD8C18710

Function 00007FF7B3C69014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C69046

Part of subcall function 00007FF7B3C6A948: HeapFree.KERNEL32(?,?,?,00007FF7B3C72D22,?,?,?,00007FF7B3C72D5F,?,?,00000000,00007FF7B3C73225,?,?,?,00007FF7B3C73157), ref: 00007FF7B3C6A95E
Part of subcall function 00007FF7B3C6A948: GetLastError.KERNEL32(?,?,?,00007FF7B3C72D22,?,?,?,00007FF7B3C72D5F,?,?,00000000,00007FF7B3C73225,?,?,?,00007FF7B3C73157), ref: 00007FF7B3C6A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7B3C5CBA5), ref: 00007FF7B3C69064

Strings

C:\Users\user\Desktop\cPl7CoJTBx.exe, xrefs: 00007FF7B3C69052

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\cPl7CoJTBx.exe
API String ID: 3580290477-2922186201
Opcode ID: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction ID: 8fa9ce8d65cf2c5f7158b3a9acfcb9b193cd345d83de12f831f635a1e13d76a3
Opcode Fuzzy Hash: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction Fuzzy Hash: DA41A735A08B0285E795FFA9D8480BCA3A4EF567D0B954035EB4DA37C9DE3DE4C18360

Function 00007FF7B3C6CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7B3C6CD4F
GetLastError.KERNEL32 ref: 00007FF7B3C6CD71

Strings

U, xrefs: 00007FF7B3C6CCFB

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: d7fa3282d13d3de43bcc43f3dd4121cda039b19314119a8e76932be0c9b7c8a6
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: 9E41C732718A4191D7A09FA9E4483B9B760FBA9784F908131EF4D97799EF3CD481C750

Function 00007FF7B3C6F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7B3C6F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7B3C6F64A

Strings

:, xrefs: 00007FF7B3C6F60E

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
Instruction ID: b87bd2e3f38b4ac0488f27b22677880de69ee90b18a3ca4c00c61874000cbdb0
Opcode Fuzzy Hash: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
Instruction Fuzzy Hash: 8321D572B0824181EBA0AB59D04C27DB3B1FBA5B44FC54035DB4DA36D8DF7CD5848761

Function 00007FF7B3C5FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7B3C5FD98
RaiseException.KERNEL32 ref: 00007FF7B3C5FDD9

Strings

csm, xrefs: 00007FF7B3C5FDC6

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: ef27b275bd2319b417d08c1fde4ed6a23c3643ba749fe8c065e82adee24811e2
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: E1115E32608B8582EB659F19E404269B7E4FB99B84F594231EF8D17798DF3CD5918B00

Function 00007FF8A82ECCFA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FF8A82ECD31
BIO_printf.LIBCRYPTO-3 ref: 00007FF8A82ECD67

Strings

%s (%d), xrefs: 00007FF8A82ECD5D

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: O_indentO_printf
String ID: %s (%d)
API String ID: 1860387303-2206749211
Opcode ID: 84165c5a742860087a4181324a4083d95e8c5db66e94e6bdcefa2ca088d4fd60
Instruction ID: bffa6d39a041c60ccafaf26ac9cf9eee776e40ddae1b7e587d0e2ed85b5dbba7
Opcode Fuzzy Hash: 84165c5a742860087a4181324a4083d95e8c5db66e94e6bdcefa2ca088d4fd60
Instruction Fuzzy Hash: DA019236A1D69A96EA518B05A0002BD6F50FB86FD0F498031CE5E07759EF3DE042C72C

Function 00007FF7B3C7073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B3C7076C
GetDriveTypeW.KERNEL32 ref: 00007FF7B3C707AC

Strings

:, xrefs: 00007FF7B3C70795

Memory Dump Source

Source File: 00000002.00000002.2195382271.00007FF7B3C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B3C50000, based on PE: true

Associated: 00000002.00000002.2195357635.00007FF7B3C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195452156.00007FF7B3C7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195524780.00007FF7B3C91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2195617589.00007FF7B3C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b3c50000_cPl7CoJTBx.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 3ac7fce3e76c7c94538732f289e15589dd2d81275672eb41847e65b7befdfdae
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 4C01D821918202C6F7E0BFE894292BEA390EF66745FC01035DB4D932C9DF3CD5808B24

Function 00007FF8A82C4D6F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-3 ref: 00007FF8A82C4F74

Strings

SHA256, xrefs: 00007FF8A82C4EEA
RC2(128), xrefs: 00007FF8A82C4D6F

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: O_snprintf
String ID: RC2(128)$SHA256
API String ID: 3142812517-4086923701
Opcode ID: c4dc322602219df1bdf4739992d4b7258ce7f788ac0d61bfc740f83ae17cdb61
Instruction ID: e168955273ccb78508145f7b6d42ef4a32336eafb53500b7180d14feb52d05ca
Opcode Fuzzy Hash: c4dc322602219df1bdf4739992d4b7258ce7f788ac0d61bfc740f83ae17cdb61
Instruction Fuzzy Hash: 6A017173C0AA96A1E2709B15B44407B66A0FB413D4F450136EE8C23A9CCF3CE9518658

Function 00007FF8A82C4D63 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-3 ref: 00007FF8A82C4F74

Strings

RC4(128), xrefs: 00007FF8A82C4D63
SHA256, xrefs: 00007FF8A82C4EEA

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: O_snprintf
String ID: RC4(128)$SHA256
API String ID: 3142812517-1400659560
Opcode ID: d6a0065a6d0874dd0ff966604a2627c7be0b620d4a919fb648158f234155b9c5
Instruction ID: 26ebe7c359bb4d60e737a696913de38f366c34be2e8ba65fec23787109c726f8
Opcode Fuzzy Hash: d6a0065a6d0874dd0ff966604a2627c7be0b620d4a919fb648158f234155b9c5
Instruction Fuzzy Hash: 1C017173C0AA96A1E2709B15A44407B66A0FB413D4F450136EE8C23AACCF3CE9519658

Function 00007FF8A82C4D57 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-3 ref: 00007FF8A82C4F74

Strings

3DES(168), xrefs: 00007FF8A82C4D57
SHA256, xrefs: 00007FF8A82C4EEA

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: O_snprintf
String ID: 3DES(168)$SHA256
API String ID: 3142812517-1425382332
Opcode ID: f6a822f7e7e8ce570bfc8d8c29e818f6c1a49bc9590b4984a5e4dfc449007e0a
Instruction ID: 741012db75e48f2a6a4c23a7d95608e9cc6bb2c22a63cf4ea1462c109e1e9839
Opcode Fuzzy Hash: f6a822f7e7e8ce570bfc8d8c29e818f6c1a49bc9590b4984a5e4dfc449007e0a
Instruction Fuzzy Hash: 86017173C0AA96A1E2709B15A44407B66A0FB413D4F450136EE8C23A9CCF3CE9518758

Function 00007FF8A82C4D4B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-3 ref: 00007FF8A82C4F74

Strings

SHA256, xrefs: 00007FF8A82C4EEA
DES(56), xrefs: 00007FF8A82C4D4B

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: O_snprintf
String ID: DES(56)$SHA256
API String ID: 3142812517-3688456565
Opcode ID: 864fc7dfa8d5e77a62175dc00898ddbbd5d6343fefe8c2cb9755a45508bb71f7
Instruction ID: aaa4d7a9710e5c235522bc6ed8a1fbd71b4f5ca049aba9cd4c96295c3c064838
Opcode Fuzzy Hash: 864fc7dfa8d5e77a62175dc00898ddbbd5d6343fefe8c2cb9755a45508bb71f7
Instruction Fuzzy Hash: 68017173C0AA96A1E2709B15A44407BA7A0FB413D4F450136EE8C23A9CCF3CE9519658

Function 00007FF8A8014C18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8A8014C68
PyUnicode_FromString.PYTHON312 ref: 00007FF8A8014C85

Strings

no such name, xrefs: 00007FF8A8014C5E

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: String$Err_FromUnicode_
String ID: no such name
API String ID: 3678473424-4211486178
Opcode ID: 4348d4c1af8cee514543b61df3cc81d6ff16b058532f076f9cdf87de5dea6c2b
Instruction ID: 4d76057ad4dacdf8c3c09f781887f86edc7adeee9a7a86176cbe93c25a6057da
Opcode Fuzzy Hash: 4348d4c1af8cee514543b61df3cc81d6ff16b058532f076f9cdf87de5dea6c2b
Instruction Fuzzy Hash: F801257161AA42E5EF518B11E4517B56391FF587D5F440031DA4E867E0EF3CE1148728

Function 00007FF8A8135B95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8135BA8
_msize.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8135BB9

Strings

failed memory resize %u to %u bytes, xrefs: 00007FF8A8135BC2

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: _msizerealloc
String ID: failed memory resize %u to %u bytes
API String ID: 2713192863-2134078882
Opcode ID: 1620b94e1496c3a76f9313f6941ee5be211108b89c88192d34549017afd6c90c
Instruction ID: 791cf6806c7f9e416ce8b44aa03968aef9c97328d168b994d4575660f3e83b74
Opcode Fuzzy Hash: 1620b94e1496c3a76f9313f6941ee5be211108b89c88192d34549017afd6c90c
Instruction Fuzzy Hash: 54E09254B0E78192EA544B57B9441795261FF4CFC5F145031EE4E17B5DEF2CE491C318

Function 00007FF8A80125A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_PyObject_GC_New.PYTHON312(?,?,00000000,00007FF8A8012513), ref: 00007FF8A80125A6
PyObject_GC_Track.PYTHON312(?,?,00000000,00007FF8A8012513), ref: 00007FF8A80125D8

Strings

3.2.0, xrefs: 00007FF8A80125B4

Memory Dump Source

Source File: 00000002.00000002.2196464342.00007FF8A8011000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8010000, based on PE: true

Associated: 00000002.00000002.2196429072.00007FF8A8010000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8015000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A8072000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A80C7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196518813.00007FF8A811F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2196993541.00007FF8A8122000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2197086216.00007FF8A8124000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8010000_cPl7CoJTBx.jbxd

Similarity

API ID: Object_$Track
String ID: 3.2.0
API String ID: 16854473-1786766648
Opcode ID: 05fdb2ae452a8d6f4b3be3f11c3efdbfda8cc49ab31c9f152460280c20d50ee3
Instruction ID: 85cd8c00c00975cd10f5b440ed72a6dbb101d20e1814fe63854a8b416c7c8d18
Opcode Fuzzy Hash: 05fdb2ae452a8d6f4b3be3f11c3efdbfda8cc49ab31c9f152460280c20d50ee3
Instruction Fuzzy Hash: 23E0ED35A0BB06F9EF158B11E89406873A4FF097A4F540135CD4C06390EF3CE574C268

Function 00007FF8A82CED47 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82CED62
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A82CED74

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A82CED5B

Memory Dump Source

Source File: 00000002.00000002.2197442855.00007FF8A82B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A82B0000, based on PE: true

Associated: 00000002.00000002.2197386642.00007FF8A82B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197442855.00007FF8A8333000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197597500.00007FF8A8335000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197631772.00007FF8A835D000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8362000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8368000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2197712211.00007FF8A8370000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a82b0000_cPl7CoJTBx.jbxd

Similarity

API ID: R_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 543922902-1080266419
Opcode ID: de5fdb307b945420a9f6eed53d2437f0b09c6605f83c4cf29a178b20c6a34943
Instruction ID: 4cf44761616f4641bffd3d4c8fe1ebe58b6810cbb6270bc3c1fbc1f6fb4c83ac
Opcode Fuzzy Hash: de5fdb307b945420a9f6eed53d2437f0b09c6605f83c4cf29a178b20c6a34943
Instruction Fuzzy Hash: 32E0C21161E6C21BE741D3B4C8A1AE92F11DB93394F881274D39942DD7DB0CD0928316

Function 00007FF8A817DB10 Relevance: 5.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A817DBF7
memcpy.VCRUNTIME140 ref: 00007FF8A817DC4B
memcpy.VCRUNTIME140 ref: 00007FF8A817DCA7
memcpy.VCRUNTIME140 ref: 00007FF8A817DD27

Memory Dump Source

Source File: 00000002.00000002.2197143780.00007FF8A8131000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8130000, based on PE: true

Associated: 00000002.00000002.2197116660.00007FF8A8130000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197277085.00007FF8A8264000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197332151.00007FF8A8293000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2197358110.00007FF8A8298000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8130000_cPl7CoJTBx.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 1485575833ac080eba873b396e4fec7d0adbbe42a312c587b8f7937f0ac7c60a
Instruction ID: 129615734a25c3b25875f936988b8da637879851c0eda3a503d1d59a1e5c35cf
Opcode Fuzzy Hash: 1485575833ac080eba873b396e4fec7d0adbbe42a312c587b8f7937f0ac7c60a
Instruction Fuzzy Hash: 7791E331A0B74AA6EA669F1291403793B90FB45BD0F585638DE6D077C9EF3CE450CB18

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cPl7CoJTBx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Luna-Logged-user.zip

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_ARC4.pyd

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_Salsa20.pyd

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_chacha20.pyd

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_pkcs1_decode.pyd

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_aes.pyd

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_aesni.pyd

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_arc2.pyd

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_blowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_cast.pyd

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_cbc.pyd

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_cfb.pyd

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ctr.pyd

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_des.pyd

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_des3.pyd

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_ecb.pyd

C:\Users\user\AppData\Local\Temp\_MEI59722\Cryptodome\Cipher\_raw_eksblowfish.pyd

Windows Analysis Report
cPl7CoJTBx.exe