Edit tour

Windows Analysis Report
grass.exe

Overview

General Information

Sample name:	grass.exe
Analysis ID:	1559571
MD5:	bde4b588168e995961f49b6cb7576594
SHA1:	1a28c66e77e4a7cea5b2e49d116dd20d3d046120
SHA256:	bedf5dc3e40558fcffb4eee7d9efc20db06a1f77433e0c46d247dd4f2640e6f0
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Contains functionality to infect the boot sector

Found pyInstaller with non standard icon

Machine Learning detection for sample

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

grass.exe (PID: 7552 cmdline: "C:\Users\user\Desktop\grass.exe" MD5: BDE4B588168E995961F49B6CB7576594)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

grass.exe (PID: 7664 cmdline: "C:\Users\user\Desktop\grass.exe" MD5: BDE4B588168E995961F49B6CB7576594)

cmd.exe (PID: 7700 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cleanup

Code function: 3_2_61CD3CF0 WSAStartup,gethostbyname,socket,setsockopt,setsockopt,setsockopt,htons,sendto,sendto,recvfrom,recvfrom,ntohl,ntohl,ntohl,closesocket,WSACleanup,WSAGetLastError,closesocket,WSACleanup,SetLastError,WSAGetLastError,WSACleanup,SetLastError,

3_2_61CD3CF0

Source: C:\Users\user\Desktop\grass.exe

Code function: 3_2_61CD2B30: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle,

3_2_61CD2B30

Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1B6E10	0_2_00007FF69E1B6E10
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E197E40	0_2_00007FF69E197E40
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1B7B74	0_2_00007FF69E1B7B74
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1B1AD8	0_2_00007FF69E1B1AD8
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1AEF58	0_2_00007FF69E1AEF58
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1A2758	0_2_00007FF69E1A2758
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1A8FC0	0_2_00007FF69E1A8FC0
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E19983B	0_2_00007FF69E19983B
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1B708C	0_2_00007FF69E1B708C
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1A10C8	0_2_00007FF69E1A10C8
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E198D60	0_2_00007FF69E198D60
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1AF5D8	0_2_00007FF69E1AF5D8
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1AADC0	0_2_00007FF69E1AADC0
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1B4E20	0_2_00007FF69E1B4E20
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1B1AD8	0_2_00007FF69E1B1AD8
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1B7628	0_2_00007FF69E1B7628
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1A9670	0_2_00007FF69E1A9670
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1A16DC	0_2_00007FF69E1A16DC
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1A36F0	0_2_00007FF69E1A36F0
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1A0EBC	0_2_00007FF69E1A0EBC
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1A3F2C	0_2_00007FF69E1A3F2C
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1A43F0	0_2_00007FF69E1A43F0
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1A23C0	0_2_00007FF69E1A23C0
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1A6C90	0_2_00007FF69E1A6C90
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1A14D8	0_2_00007FF69E1A14D8
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1A0CB8	0_2_00007FF69E1A0CB8
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1BA938	0_2_00007FF69E1BA938
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1999D4	0_2_00007FF69E1999D4
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E19A20D	0_2_00007FF69E19A20D
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1B2A84	0_2_00007FF69E1B2A84
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1AEAC4	0_2_00007FF69E1AEAC4
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1B52BC	0_2_00007FF69E1B52BC
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1A12CC	0_2_00007FF69E1A12CC
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1A3B28	0_2_00007FF69E1A3B28
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CC5080	3_2_61CC5080
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CC6530	3_2_61CC6530
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D631D8	3_2_61D631D8
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CE51C0	3_2_61CE51C0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D18195	3_2_61D18195
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D631B8	3_2_61D631B8
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D63138	3_2_61D63138
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D170F0	3_2_61D170F0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CD6050	3_2_61CD6050
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CD8010	3_2_61CD8010
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CE4390	3_2_61CE4390
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D1A340	3_2_61D1A340
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CED2C0	3_2_61CED2C0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D282F0	3_2_61D282F0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CE72E0	3_2_61CE72E0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CE1240	3_2_61CE1240
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CCA260	3_2_61CCA260
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CD5260	3_2_61CD5260
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CEA200	3_2_61CEA200
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CC7540	3_2_61CC7540
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D02562	3_2_61D02562
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CD8530	3_2_61CD8530
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CE84A0	3_2_61CE84A0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CD74B0	3_2_61CD74B0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CD14B2	3_2_61CD14B2
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D196D0	3_2_61D196D0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D096C0	3_2_61D096C0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D21690	3_2_61D21690
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D41670	3_2_61D41670
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CE0980	3_2_61CE0980
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CD49B0	3_2_61CD49B0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D3F940	3_2_61D3F940
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D028F0	3_2_61D028F0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CE8890	3_2_61CE8890
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D178B0	3_2_61D178B0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CD4830	3_2_61CD4830
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D18BB0	3_2_61D18BB0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D28A10	3_2_61D28A10
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CCBDE0	3_2_61CCBDE0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CE9DE0	3_2_61CE9DE0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CE8D80	3_2_61CE8D80
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CC7D70	3_2_61CC7D70
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CEBC80	3_2_61CEBC80
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CEEC50	3_2_61CEEC50
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CEEED0	3_2_61CEEED0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CD7E70	3_2_61CD7E70
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D27E10	3_2_61D27E10
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CDBE10	3_2_61CDBE10
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1B7B74	3_2_00007FF69E1B7B74
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1AEF58	3_2_00007FF69E1AEF58
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1A2758	3_2_00007FF69E1A2758
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1A8FC0	3_2_00007FF69E1A8FC0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E19983B	3_2_00007FF69E19983B
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1B708C	3_2_00007FF69E1B708C
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1A10C8	3_2_00007FF69E1A10C8
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E198D60	3_2_00007FF69E198D60
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1AF5D8	3_2_00007FF69E1AF5D8
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1AADC0	3_2_00007FF69E1AADC0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1B4E20	3_2_00007FF69E1B4E20
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1B1AD8	3_2_00007FF69E1B1AD8
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1B7628	3_2_00007FF69E1B7628
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1B6E10	3_2_00007FF69E1B6E10
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1A9670	3_2_00007FF69E1A9670
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E197E40	3_2_00007FF69E197E40
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1A16DC	3_2_00007FF69E1A16DC
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1A36F0	3_2_00007FF69E1A36F0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1A0EBC	3_2_00007FF69E1A0EBC
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1A3F2C	3_2_00007FF69E1A3F2C
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1A43F0	3_2_00007FF69E1A43F0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1A23C0	3_2_00007FF69E1A23C0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1A6C90	3_2_00007FF69E1A6C90
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1A14D8	3_2_00007FF69E1A14D8
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1A0CB8	3_2_00007FF69E1A0CB8
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1BA938	3_2_00007FF69E1BA938
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1999D4	3_2_00007FF69E1999D4
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E19A20D	3_2_00007FF69E19A20D
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1B2A84	3_2_00007FF69E1B2A84
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1B1AD8	3_2_00007FF69E1B1AD8
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1AEAC4	3_2_00007FF69E1AEAC4
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1B52BC	3_2_00007FF69E1B52BC
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1A12CC	3_2_00007FF69E1A12CC
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1A3B28	3_2_00007FF69E1A3B28
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B98BC40	3_2_00007FFB0B98BC40
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B984C80	3_2_00007FFB0B984C80
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B9851C4	3_2_00007FFB0B9851C4
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B9931A9	3_2_00007FFB0B9931A9
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B98F1B0	3_2_00007FFB0B98F1B0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B98E0B0	3_2_00007FFB0B98E0B0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B98A880	3_2_00007FFB0B98A880
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B985754	3_2_00007FFB0B985754
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B988EBC	3_2_00007FFB0B988EBC
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B98EEE0	3_2_00007FFB0B98EEE0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B98D6F0	3_2_00007FFB0B98D6F0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B98FD00	3_2_00007FFB0B98FD00
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B9C7DF0	3_2_00007FFB0B9C7DF0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA67450	3_2_00007FFB0BA67450
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA82230	3_2_00007FFB0BA82230
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA5B620	3_2_00007FFB0BA5B620
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA64690	3_2_00007FFB0BA64690
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA5E090	3_2_00007FFB0BA5E090
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA61290	3_2_00007FFB0BA61290
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA5B270	3_2_00007FFB0BA5B270
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA3786B	3_2_00007FFB0BA3786B
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA47E70	3_2_00007FFB0BA47E70
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA32070	3_2_00007FFB0BA32070
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA7E860	3_2_00007FFB0BA7E860
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA77660	3_2_00007FFB0BA77660
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA5F5D0	3_2_00007FFB0BA5F5D0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA429D0	3_2_00007FFB0BA429D0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA76FC0	3_2_00007FFB0BA76FC0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA809A0	3_2_00007FFB0BA809A0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA469A0	3_2_00007FFB0BA469A0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA35BA0	3_2_00007FFB0BA35BA0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA5A810	3_2_00007FFB0BA5A810
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA65C00	3_2_00007FFB0BA65C00
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA4BA00	3_2_00007FFB0BA4BA00
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA7F400	3_2_00007FFB0BA7F400
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA70600	3_2_00007FFB0BA70600
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA641E0	3_2_00007FFB0BA641E0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA5F9E0	3_2_00007FFB0BA5F9E0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA77D50	3_2_00007FFB0BA77D50
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA44750	3_2_00007FFB0BA44750
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA66F40	3_2_00007FFB0BA66F40
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA7C340	3_2_00007FFB0BA7C340
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA3C940	3_2_00007FFB0BA3C940
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA3DF20	3_2_00007FFB0BA3DF20
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA59D90	3_2_00007FFB0BA59D90
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA7DB70	3_2_00007FFB0BA7DB70
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA81B60	3_2_00007FFB0BA81B60
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA3A560	3_2_00007FFB0BA3A560
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA33D60	3_2_00007FFB0BA33D60
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA668C0	3_2_00007FFB0BA668C0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA366C0	3_2_00007FFB0BA366C0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA60EB0	3_2_00007FFB0BA60EB0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA7FEB0	3_2_00007FFB0BA7FEB0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA794B0	3_2_00007FFB0BA794B0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA77AA0	3_2_00007FFB0BA77AA0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA7B710	3_2_00007FFB0BA7B710
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA62700	3_2_00007FFB0BA62700
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA3B300	3_2_00007FFB0BA3B300
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA708F0	3_2_00007FFB0BA708F0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA458F0	3_2_00007FFB0BA458F0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA62AE0	3_2_00007FFB0BA62AE0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA5C8E0	3_2_00007FFB0BA5C8E0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21537	3_2_00007FFB0BC21537
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC26BA0	3_2_00007FFB0BC26BA0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC80B50	3_2_00007FFB0BC80B50
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC220B3	3_2_00007FFB0BC220B3
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2168B	3_2_00007FFB0BC2168B
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC22572	3_2_00007FFB0BC22572
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC88460	3_2_00007FFB0BC88460
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC70240	3_2_00007FFB0BC70240
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2195B	3_2_00007FFB0BC2195B
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21DD4	3_2_00007FFB0BC21DD4
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21398	3_2_00007FFB0BC21398
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2114F	3_2_00007FFB0BC2114F
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21451	3_2_00007FFB0BC21451
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2F9C5	3_2_00007FFB0BC2F9C5
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21C99	3_2_00007FFB0BC21C99

Source: C:\Users\user\Desktop\grass.exe	Code function: String function: 00007FFB0BC212EE appears 382 times
Source: C:\Users\user\Desktop\grass.exe	Code function: String function: 00007FFB0B9A779C appears 32 times
Source: C:\Users\user\Desktop\grass.exe	Code function: String function: 61D62C68 appears 51 times
Source: C:\Users\user\Desktop\grass.exe	Code function: String function: 00007FFB0BC8E055 appears 73 times
Source: C:\Users\user\Desktop\grass.exe	Code function: String function: 61D62C20 appears 44 times
Source: C:\Users\user\Desktop\grass.exe	Code function: String function: 00007FFB0BC8DFBF appears 152 times
Source: C:\Users\user\Desktop\grass.exe	Code function: String function: 00007FF69E192020 appears 34 times
Source: C:\Users\user\Desktop\grass.exe	Code function: String function: 00007FFB0B9CDC00 appears 40 times
Source: C:\Users\user\Desktop\grass.exe	Code function: String function: 61CDDD10 appears 235 times
Source: C:\Users\user\Desktop\grass.exe	Code function: String function: 00007FF69E191E50 appears 106 times

Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: pyarmor_runtime.pyd.0.dr

Static PE information: Number of sections : 11 > 10

Source: grass.exe, 00000000.00000003.1372479234.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs grass.exe
Source: grass.exe, 00000000.00000003.1372633631.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs grass.exe
Source: grass.exe, 00000000.00000003.1372714595.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs grass.exe
Source: grass.exe, 00000000.00000003.1371651052.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs grass.exe
Source: grass.exe, 00000000.00000003.1379416969.0000016256B81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs grass.exe
Source: grass.exe, 00000000.00000003.1379612810.0000016256B89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs grass.exe
Source: grass.exe, 00000000.00000003.1372106670.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs grass.exe
Source: grass.exe, 00000000.00000003.1371876072.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs grass.exe
Source: grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs grass.exe
Source: grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs grass.exe
Source: grass.exe, 00000000.00000003.1372801356.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs grass.exe
Source: grass.exe, 00000000.00000003.1373137867.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs grass.exe
Source: grass.exe, 00000000.00000003.1372998674.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs grass.exe
Source: grass.exe, 00000000.00000003.1370943889.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs grass.exe
Source: grass.exe, 00000000.00000003.1371125051.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs grass.exe
Source: grass.exe, 00000000.00000003.1377710073.0000016256B81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs grass.exe
Source: grass.exe, 00000000.00000003.1372878642.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs grass.exe
Source: grass.exe	Binary or memory string: OriginalFilename vs grass.exe
Source: grass.exe, 00000003.00000002.2631741021.00007FFB0C478000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython310.dll. vs grass.exe
Source: grass.exe, 00000003.00000002.2632377822.00007FFB1BA72000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs grass.exe
Source: grass.exe, 00000003.00000002.2633024550.00007FFB1D5BA000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs grass.exe
Source: grass.exe, 00000003.00000002.2631940607.00007FFB0CB14000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs grass.exe
Source: grass.exe, 00000003.00000002.2632759723.00007FFB1C26D000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs grass.exe
Source: grass.exe, 00000003.00000002.2632462181.00007FFB1BA8E000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs grass.exe
Source: grass.exe, 00000003.00000002.2632672937.00007FFB1BAE2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs grass.exe
Source: grass.exe, 00000003.00000002.2633108295.00007FFB1D894000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs grass.exe
Source: grass.exe, 00000003.00000002.2633277113.00007FFB1E3C7000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs grass.exe
Source: grass.exe, 00000003.00000002.2633191489.00007FFB1E3A6000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs grass.exe
Source: grass.exe, 00000003.00000002.2630546609.00007FFB0BC11000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs grass.exe
Source: grass.exe, 00000003.00000002.2632288414.00007FFB1BA4E000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs grass.exe
Source: grass.exe, 00000003.00000002.2630020492.00007FFB0B9BA000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs grass.exe
Source: grass.exe, 00000003.00000002.2632591293.00007FFB1BAC5000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs grass.exe
Source: grass.exe, 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenamelibsslH vs grass.exe
Source: grass.exe, 00000003.00000002.2631138306.00007FFB0C019000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs grass.exe

Source: classification engine

Classification label: mal52.winEXE@6/36@1/1

Source: C:\Users\user\Desktop\grass.exe

Code function: 3_2_61CD27E0 GetLastError,FormatMessageA,LocalFree,

3_2_61CD27E0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03

Source: C:\Users\user\Desktop\grass.exe

File created: C:\Users\user~1\AppData\Local\Temp\_MEI75522

Jump to behavior

Source: grass.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\grass.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\grass.exe

File read: C:\Users\user\Desktop\grass.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\grass.exe "C:\Users\user\Desktop\grass.exe"
Source: C:\Users\user\Desktop\grass.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\grass.exe	Process created: C:\Users\user\Desktop\grass.exe "C:\Users\user\Desktop\grass.exe"
Source: C:\Users\user\Desktop\grass.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\Desktop\grass.exe	Process created: C:\Users\user\Desktop\grass.exe "C:\Users\user\Desktop\grass.exe"	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior

Source: C:\Users\user\Desktop\grass.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\grass.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: grass.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: grass.exe

Static file information: File size 8394086 > 1048576

Source: grass.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: grass.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: grass.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: grass.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: grass.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: grass.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: grass.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: grass.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: grass.exe, 00000000.00000003.1379612810.0000016256B89000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2630398487.00007FFB0BC0C000.00000002.00000001.01000000.00000015.sdmp, unicodedata.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb## source: grass.exe, 00000003.00000002.2629916648.00007FFB0B9A9000.00000002.00000001.01000000.0000001E.sdmp, _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: grass.exe, 00000000.00000003.1372479234.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2631883352.00007FFB0CB0B000.00000002.00000001.01000000.00000012.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: grass.exe, 00000003.00000002.2629916648.00007FFB0B9A9000.00000002.00000001.01000000.0000001E.sdmp, _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: grass.exe, 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmp, libssl-1_1.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: grass.exe, 00000003.00000002.2630991307.00007FFB0BF20000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: grass.exe, 00000000.00000003.1372714595.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2632986985.00007FFB1D5B5000.00000002.00000001.01000000.00000010.sdmp, _overlapped.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: grass.exe, 00000000.00000003.1372633631.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: grass.exe, 00000003.00000002.2630991307.00007FFB0BFA2000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb source: grass.exe, 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmp, libssl-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: grass.exe, 00000000.00000003.1379416969.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2633159238.00007FFB1E3A3000.00000002.00000001.01000000.00000009.sdmp, select.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: grass.exe, 00000003.00000002.2630991307.00007FFB0BF20000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-1_1.dll.0.dr
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: grass.exe, 00000000.00000003.1370943889.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2633244818.00007FFB1E3C1000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: grass.exe, 00000003.00000002.2632725904.00007FFB1C260000.00000002.00000001.01000000.00000006.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2632254758.00007FFB1BA46000.00000002.00000001.01000000.00000014.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: grass.exe, 00000000.00000003.1373137867.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2633075890.00007FFB1D892000.00000002.00000001.01000000.0000000E.sdmp, _uuid.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: grass.exe, 00000000.00000003.1371125051.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2632427176.00007FFB1BA87000.00000002.00000001.01000000.0000000F.sdmp, _asyncio.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python310.pdb source: grass.exe, 00000003.00000002.2631382922.00007FFB0C36F000.00000002.00000001.01000000.00000004.sdmp, python310.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: pyexpat.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: grass.exe, 00000000.00000003.1372801356.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, _queue.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: grass.exe, 00000000.00000003.1372479234.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2631883352.00007FFB0CB0B000.00000002.00000001.01000000.00000012.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: grass.exe, 00000000.00000003.1371651052.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2632341708.00007FFB1BA6D000.00000002.00000001.01000000.00000011.sdmp, _bz2.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: grass.exe, 00000000.00000003.1372878642.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2632640023.00007FFB1BAD8000.00000002.00000001.01000000.00000008.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: grass.exe, 00000003.00000002.2632515183.00007FFB1BAAD000.00000002.00000001.01000000.0000000B.sdmp, _ssl.pyd.0.dr

Source: grass.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: grass.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: grass.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: grass.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: grass.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\grass.exe

Code function: 3_2_61CC1D00 LoadLibraryA,GetProcAddress,GetCurrentThread,

3_2_61CC1D00

Source: _helpers.cp310-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x15b8c
Source: _helpers_c.cp310-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x15676
Source: pyarmor_runtime.pyd.0.dr	Static PE information: real checksum: 0x9c12b should be: 0xaaa50
Source: _quoting_c.cp310-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x263e6
Source: _http_parser.cp310-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x4b42b
Source: _http_writer.cp310-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xc9ac
Source: _multidict.cp310-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xcc8d
Source: _websocket.cp310-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xba7b
Source: _frozenlist.cp310-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1a2df
Source: _brotli.cp310-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xd0a91

Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: python310.dll.0.dr	Static PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: pyarmor_runtime.pyd.0.dr	Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D489D8 push qword ptr [rax+60FFF8C3h]; ret		3_2_61D489E1
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CD5E02 push rdx; iretd		3_2_61CD5E03

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\grass.exe	Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d		3_2_61CD2B30
Source: C:\Users\user\Desktop\grass.exe	Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d		3_2_61CD2EE0

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\grass.exe

Process created: "C:\Users\user\Desktop\grass.exe"

Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\pyarmor_runtime_000000\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_websocket.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\yarl\_quoting_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\propcache\_helpers_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\_brotli.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\frozenlist\_frozenlist.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_http_parser.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_http_writer.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\multidict\_multidict.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_helpers.cp310-win_amd64.pyd	Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\grass.exe	Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d		3_2_61CD2B30
Source: C:\Users\user\Desktop\grass.exe	Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d		3_2_61CD2EE0

Source: C:\Users\user\Desktop\grass.exe

Code function: 0_2_00007FF69E194C60 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF69E194C60

Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\pyarmor_runtime_000000\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_websocket.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\yarl\_quoting_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\propcache\_helpers_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\_brotli.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\frozenlist\_frozenlist.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_http_parser.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_http_writer.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\multidict\_multidict.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_helpers.cp310-win_amd64.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\grass.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-19335

Source: C:\Users\user\Desktop\grass.exe

API coverage: 1.5 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1987E0 FindFirstFileExW,FindClose,	0_2_00007FF69E1987E0
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E197820 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF69E197820
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1B2A84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF69E1B2A84
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1987E0 FindFirstFileExW,FindClose,	3_2_00007FF69E1987E0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E197820 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_00007FF69E197820
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1B2A84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00007FF69E1B2A84

Source: grass.exe, 00000003.00000002.2628108784.00000248F21A0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\grass.exe

Code function: 0_2_00007FF69E19C69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF69E19C69C

Source: C:\Users\user\Desktop\grass.exe

Code function: 3_2_61CC1D00 LoadLibraryA,GetProcAddress,GetCurrentThread,

3_2_61CC1D00

Source: C:\Users\user\Desktop\grass.exe

Code function: 0_2_00007FF69E1B4690 GetProcessHeap,

0_2_00007FF69E1B4690

Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E19C840 SetUnhandledExceptionFilter,	0_2_00007FF69E19C840
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E19BE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF69E19BE00
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E19C69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF69E19C69C
Source: C:\Users\user\Desktop\grass.exe	Code function: 0_2_00007FF69E1AB4F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF69E1AB4F8
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D40410 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	3_2_61D40410
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E19C840 SetUnhandledExceptionFilter,	3_2_00007FF69E19C840
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E19BE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF69E19BE00
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E19C69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF69E19C69C
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FF69E1AB4F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF69E1AB4F8
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B9A06A8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FFB0B9A06A8
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B99FD80 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FFB0B99FD80
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B9CEE80 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FFB0B9CEE80
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0B9CE8B0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FFB0B9CE8B0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BA84050 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FFB0BA84050

Source: C:\Users\user\Desktop\grass.exe	Process created: C:\Users\user\Desktop\grass.exe "C:\Users\user\Desktop\grass.exe"			Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"			Jump to behavior

Source: C:\Users\user\Desktop\grass.exe

Code function: 0_2_00007FF69E1BA780 cpuid

0_2_00007FF69E1BA780

Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\attrs-24.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\attrs-24.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\attrs-24.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\attrs-24.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\attrs-24.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\frozenlist VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\libffi-7.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\propcache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_brotli.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_overlapped.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\pyarmor_runtime_000000 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\pyarmor_runtime_000000 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\pyarmor_runtime_000000 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\pyarmor_runtime_000000 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\pyarmor_runtime_000000\pyarmor_runtime.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_uuid.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_asyncio.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_overlapped.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\multidict\_multidict.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\yarl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\yarl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\propcache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\propcache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\propcache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\propcache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\propcache\_helpers_c.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\yarl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\yarl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\yarl\_quoting_c.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_helpers.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_brotli.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_http_writer.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_http_parser.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_websocket.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\frozenlist VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\frozenlist VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\frozenlist VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\frozenlist VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\frozenlist\_frozenlist.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522\_decimal.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\Desktop\grass.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\grass.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75522 VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\grass.exe

Code function: 0_2_00007FF69E19C580 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF69E19C580

Source: C:\Users\user\Desktop\grass.exe

Code function: 0_2_00007FF69E1B6E10 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF69E1B6E10

Source: C:\Users\user\Desktop\grass.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 Bootkit	11 Process Injection	11 Process Injection	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Bootkit	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
grass.exe	12%	ReversingLabs	Win64.Malware.Generic
grass.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI75522\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\_brotli.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_helpers.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_http_parser.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_http_writer.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_websocket.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\frozenlist\_frozenlist.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\multidict\_multidict.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\propcache\_helpers_c.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\pyarmor_runtime_000000\pyarmor_runtime.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\python310.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75522\yarl\_quoting_c.cp310-win_amd64.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://127.0.0.1:8443	0%	Avira URL Cloud	safe
https://pendulum.eustace.io/docs/#tokens	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high
time.windows.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.co	grass.exe, 00000003.00000002.2628108784.00000248F222D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/251	grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://klaviyo.com/	grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/aio-libs/aiohttp/discussions/6044	grass.exe, 00000003.00000002.2628778138.00000248F2B00000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/sdispater	grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/wibuairdrop142	grass.exe, 00000003.00000002.2629131467.00000248F2E35000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628866343.00000248F2D3F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F24AE000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F24B0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2629146363.00000248F3030000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627789352.00000248F008F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://python.org	grass.exe, 00000003.00000002.2628273752.00000248F23A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://python.org/dev/peps/pep-0263/	grass.exe, 00000003.00000002.2631382922.00007FFB0C36F000.00000002.00000001.01000000.00000004.sdmp, python310.dll.0.dr	false		high
https://www.attrs.org/en/24.2.0/_static/sponsors/	grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
http://python.org:80	grass.exe, 00000003.00000002.2628273752.00000248F23A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	grass.exe, 00000003.00000002.2627789352.00000248F0108000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388498007.00000248F0109000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627789352.00000248F008F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388628958.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388989417.00000248F012C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/sponsors/hynek	METADATA.0.dr	false		high
https://github.com/python-attrs/attrs/issues/1328)	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg	grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/python-attrs/attrs)	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://www.attrs.org/)	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://docs.python.org/3/library/multiprocessing.html#contexts-and-start-methods	grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/Vpooopooo	grass.exe, 00000003.00000002.2629131467.00000248F2E35000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628866343.00000248F2D3F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F24AE000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F24B0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2629146363.00000248F3030000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627789352.00000248F008F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.kill	grass.exe, 00000003.00000002.2628633488.00000248F28A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/136	grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1391979573.00000248F2623000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	grass.exe, 00000003.00000002.2628541987.00000248F26A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/1329)	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F00DD000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F19C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F1A4C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/1330)	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F00DD000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F1A4C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2	grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	grass.exe, 00000003.00000002.2627789352.00000248F0108000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388498007.00000248F0109000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627789352.00000248F008F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388628958.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388989417.00000248F012C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/latest/names.html)	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F1A4C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F19C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://filepreviews.io/	grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://api.getgrass.io/login	grass.exe, 00000003.00000002.2628273752.00000248F23A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/why.html#data-classes)	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	grass.exe, 00000003.00000002.2627789352.00000248F0108000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388498007.00000248F0109000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627789352.00000248F008F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388628958.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388989417.00000248F012C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/functions.html#callable	grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/changelog.html	grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://www.variomedia.de/	grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://bugs.python.org/issue37179	grass.exe, 00000003.00000002.2628108784.00000248F222D000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628778138.00000248F2B00000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	grass.exe, 00000003.00000003.1388989417.00000248F012C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/	METADATA.0.dr	false		high
https://github.com/Qix-	grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	grass.exe, 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmp, _brotli.cp310-win_amd64.pyd.0.dr	false		high
https://mahler:8092/site-updates.py	grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pendulum.eustace.io/docs/#tokens	grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/download/releases/2.3/mro/.	grass.exe, 00000003.00000002.2627913587.00000248F19C0000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1387950192.00000248F21B3000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
https://github.com	grass.exe, 00000003.00000002.2628706141.00000248F29C0000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2629146363.00000248F3104000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/asyncio-eventloop.html	grass.exe, 00000003.00000002.2628778138.00000248F2B5C000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://python.org/	grass.exe, 00000003.00000002.2628108784.00000248F21A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F00DD000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F19C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0749/)-implementing	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).	grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://docs.python.org/3/glossary.html#term-coroutine-function	grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://127.0.0.1:8443	grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python-attrs/attrs	grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F1A4C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://.css	grass.exe, 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmp, _brotli.cp310-win_amd64.pyd.0.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	grass.exe, 00000003.00000002.2627789352.00000248F0108000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F00DD000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388498007.00000248F0109000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388628958.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388989417.00000248F012C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	grass.exe, 00000003.00000002.2628346347.00000248F24AE000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F24B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hynek.me/articles/import-attrs/)	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
http://cacerts.digicert.co	grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	false		high
https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek	grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support	grass.exe, 00000003.00000002.2628778138.00000248F2B00000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/changelog.html)	METADATA.0.dr	false		high
http://www.iana.org/time-zones/repository/tz-link.html	grass.exe, 00000003.00000003.1394207526.00000248F24A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/erezinman/loguru-config	grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/comparison.html#customization)	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
http://.jpg	grass.exe, 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmp, _brotli.cp310-win_amd64.pyd.0.dr	false		high
https://docs.python.org/3/library/re.html#re-objects	grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/24.2.0/_static/sponsors/Variomedia.svg	grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
http://httpbin.org/post	grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Qix-/better-exceptions	grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi	grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://www.attrs.org/en/24.2.0/_static/sponsors/Klaviyo.svg	grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
http://ocsp.thawte.com0	grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	false		high
https://www.python.org/	grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/inanitynoupcase	grass.exe, 00000003.00000002.2629131467.00000248F2E35000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628866343.00000248F2D3F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F24AE000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F24B0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2629146363.00000248F3030000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627789352.00000248F008F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://json.org	grass.exe, 00000003.00000002.2628346347.00000248F24F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/dev/peps/pep-0205/	grass.exe, 00000000.00000003.1375069994.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388164897.00000248F21C1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628201852.00000248F22A0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
https://peps.python.org/pep-0649/)	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi	grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/python-attrs/attrs/issues/428	grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1391979573.00000248F2623000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package	grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F00DD000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F1A4C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/pull/28073	grass.exe, 00000003.00000002.2628778138.00000248F2B00000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module	grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F1A4C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/24.2.0/_static/sponsors/FilePreviews.svg	grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate	grass.exe, 00000003.00000002.2627913587.00000248F1A4C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pypi.org/project/attrs/)	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://docs.python.org/3/howto/mro.html	grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1391979573.00000248F2623000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/erezinman	grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.openssl.org/H	grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmp, grass.exe, 00000003.00000002.2631138306.00007FFB0C019000.00000002.00000001.01000000.0000000C.sdmp, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr	false		high
https://www.attrs.org/en/24.2.0/_static/sponsors/Tidelift.svg	grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://docs.python.org/3/glossary.html#term-file-object	grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/sponsors/hynek).	grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://stackoverflow.com/questions/tagged/python-attrs)	grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559571
Start date and time:	2024-11-20 17:23:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	grass.exe
Detection:	MAL
Classification:	mal52.winEXE@6/36@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 69 Number of non-executed functions: 230
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 40.81.94.65
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, twc.trafficmanager.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: grass.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	https://vendor.ziphq.com/magic-link/b47e3e5c-c77a-4377-b922-4ceee97070f7	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63
	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	ACH-information-Ag.pdf.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	797F2AEA-982C-4B8E-84F4-E90FD6A89D27.1_originalmail.eml	Get hash	malicious	Unknown	Browse	13.107.246.63
	prepper-wu.ps1	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://1.midlifemouse.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPVFXRTNlSFU9JnVpZD1VU0VSMTIxMTIwMjRVNTUxMTEyMjQ=N0123Nexample@email.com	Get hash	malicious	Unknown	Browse	13.107.246.63
	SnapshotPc.ps1	Get hash	malicious	Unknown	Browse	13.107.246.63
	zhAJQgXa7S.msi	Get hash	malicious	Unknown	Browse	13.107.246.63

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI75522\VCRUNTIME140.dll	Mutant spaceship.exe	Get hash	malicious	Unknown	Browse
	Mutant spaceship.exe	Get hash	malicious	Unknown	Browse
	Mage Alteration.exe	Get hash	malicious	Unknown	Browse
	https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe	Get hash	malicious	Unknown	Browse
	crss.exe	Get hash	malicious	Unknown	Browse
	GXxC9F1xYh.exe	Get hash	malicious	Unknown	Browse
	BB.bat	Get hash	malicious	Braodo	Browse
	aLRjksjY78.exe	Get hash	malicious	HackBrowser	Browse
	Bypass Apk.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI75522\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98224
Entropy (8bit):	6.452201564717313
Encrypted:	false
SSDEEP:	1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
MD5:	F34EB034AA4A9735218686590CBA2E8B
SHA1:	2BC20ACDCB201676B77A66FA7EC6B53FA2644713
SHA-256:	9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
SHA-512:	D27D5E65E8206BD7923CF2A3C4384FEC0FC59E8BC29E25F8C03D039F3741C01D1A8C82979D7B88C10B209DB31FBBEC23909E976B3EE593DC33481F0050A445AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Mutant spaceship.exe, Detection: malicious, Browse Filename: Mutant spaceship.exe, Detection: malicious, Browse Filename: Mage Alteration.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: crss.exe, Detection: malicious, Browse Filename: GXxC9F1xYh.exe, Detection: malicious, Browse Filename: BB.bat, Detection: malicious, Browse Filename: aLRjksjY78.exe, Detection: malicious, Browse Filename: Bypass Apk.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d...%\|.a.........." .........`......p................................................{....`A.........................................B..4....J...............p..X....X...'..........h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65304
Entropy (8bit):	6.192082137044192
Encrypted:	false
SSDEEP:	1536:owmuopcJpmVwR40axzEfRILOnMv7SySmPxe:owmu4/mR40axzEfRILOnw3xe
MD5:	33D0B6DE555DDBBBD5CA229BFA91C329
SHA1:	03034826675AC93267CE0BF0EAEC9C8499E3FE17
SHA-256:	A9A99A2B847E46C0EFCE7FCFEFD27F4BCE58BAF9207277C17BFFD09EF4D274E5
SHA-512:	DBBD1DDFA445E22A0170A628387FCF3CB95E6F8B09465D76595555C4A67DA4274974BA7B348C4C81FE71C68D735C13AACB8063D3A964A8A0556FB000D68686B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.../../../..../....../...*../...+../...,../.V..../....../....../.V."../.V./../.V..../.V.-../.Rich../.........PE..d.....,d.........." .....T..........`.....................................................`.........................................p...P.......d......................../...........v..T...........................pv..8............p...............................text...aR.......T.................. ..`.rdata...I...p...J...X..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\_brotli.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	820736
Entropy (8bit):	6.056282443190043
Encrypted:	false
SSDEEP:	12288:tY0Uu7wLsglBv4i5DGAqXMAHhlyL82XTw05nmZfRFo:tp0NA1tAmZfR
MD5:	EE3D454883556A68920CAAEDEFBC1F83
SHA1:	45B4D62A6E7DB022E52C6159EEF17E9D58BEC858
SHA-256:	791E7195D7DF47A21466868F3D7386CFF13F16C51FCD0350BF4028E96278DFF1
SHA-512:	E404ADF831076D27680CC38D3879AF660A96AFC8B8E22FFD01647248C601F3C6C4585D7D7DC6BBD187660595F6A48F504792106869D329AA1A0F3707D7F777C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.r.q...q...q...x...y......s...:...s......\|......y......r.....r...q...L.....Q.....p.....p.....p...Richq...........PE..d... ..d.........." ...#.@...H.......F....................................................`.........................................@c..`....c.......................................9..............................P8..@............P...............................text....?.......@.................. ..`.rdata.......P.......D..............@..@.data........p.......`..............@....pdata...............h..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83736
Entropy (8bit):	6.595094797707322
Encrypted:	false
SSDEEP:	1536:hXOz78ZqjUyAsIi7W/5+D8W35mjZm35ILCVM7SyfYPxe:pOzwpyAFi7WMgW34jZm35ILCVMZoxe
MD5:	86D1B2A9070CD7D52124126A357FF067
SHA1:	18E30446FE51CED706F62C3544A8C8FDC08DE503
SHA-256:	62173A8FADD4BF4DD71AB89EA718754AA31620244372F0C5BBBAE102E641A60E
SHA-512:	7DB4B7E0C518A02AE901F4B24E3860122ACC67E38E73F98F993FE99EB20BB3AA539DB1ED40E63D6021861B54F34A5F5A364907FFD7DA182ADEA68BBDD5C2B535
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.>...m...m...m.}<m...m.p.l...m.jRm...m.p.l...m.p.l...m.p.l...mup.l...m.}.l...m...m...mup.l...mup.l...mupPm...mup.l...mRich...m................PE..d.....,d.........." .........\..............................................P............`......................................... ...H...h........0....... ..,......../...@......`...T...............................8............................................text.............................. ..`.rdata...=.......>..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	123672
Entropy (8bit):	6.047035801914277
Encrypted:	false
SSDEEP:	3072:0OEESRiaiH6lU1vxqfrId0sx3gVILLPykxA:hj+I1vAfrIRx3gN
MD5:	1635A0C5A72DF5AE64072CBB0065AEBE
SHA1:	C975865208B3369E71E3464BBCC87B65718B2B1F
SHA-256:	1EA3DD3DF393FA9B27BF6595BE4AC859064CD8EF9908A12378A6021BBA1CB177
SHA-512:	6E34346EA8A0AACC29CCD480035DA66E280830A7F3D220FD2F12D4CFA3E1C03955D58C0B95C2674AEA698A36A1B674325D3588483505874C2CE018135320FF99
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$............d...d...d.......d...e...d...a...d...`...d...g...d.d.e...d...`...d...e...d.:.e...d...e.I.d.d.i...d.d.d...d.d...d.d.f...d.Rich..d.........................PE..d.....,d.........." ................@Z..............................................!.....`..........................................P.......P..................D......../..............T...........................0...8...............H............................text............................... ..`.rdata...k.......l..................@..@.data...T>...p...8...\..............@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	254744
Entropy (8bit):	6.564308911485739
Encrypted:	false
SSDEEP:	6144:3LT2sto29vTlN5cdIKdo4/3VaV8FlBa9qWMa3pLW1A/T8O51j4iab9M:H2s/9vTlPcdk4vVtFU98iIu
MD5:	20C77203DDF9FF2FF96D6D11DEA2EDCF
SHA1:	0D660B8D1161E72C993C6E2AB0292A409F6379A5
SHA-256:	9AAC010A424C757C434C460C3C0A6515D7720966AB64BAD667539282A17B4133
SHA-512:	2B24346ECE2CBD1E9472A0E70768A8B4A5D2C12B3D83934F22EBDC9392D9023DCB44D2322ADA9EDBE2EB0E2C01B5742D2A83FA57CA23054080909EC6EB7CF3CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........76..VX..VX..VX.....VX..#Y..VX..#]..VX..#\..VX..#[..VX.t#Y..VX...Y..VX..VY.+VX.t#[..VX.t#U..VX.t#X..VX.t#...VX.t#Z..VX.Rich.VX.........................PE..d.....,d.........." .....\|...:.......................................................r....`..........................................T..P...0U...................'......./......<...0...T...............................8............................................text....{.......\|.................. ..`.rdata..............................@..@.data....)...p...$...X..............@....pdata...'.......(...\|..............@..@.rsrc...............................@..@.reloc..<...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64792
Entropy (8bit):	6.223467179037751
Encrypted:	false
SSDEEP:	1536:/smKJPganCspF1dqZAC2QjP2RILOIld7SyEPxDF:/smKpgNoF1dqZDnjP2RILOIv2xB
MD5:	D4674750C732F0DB4C4DD6A83A9124FE
SHA1:	FD8D76817ABC847BB8359A7C268ACADA9D26BFD5
SHA-256:	CAA4D2F8795E9A55E128409CC016E2CC5C694CB026D7058FC561E4DD131ED1C9
SHA-512:	97D57CFB80DD9DD822F2F30F836E13A52F771EE8485BC0FD29236882970F6BFBDFAAC3F2E333BBA5C25C20255E8C0F5AD82D8BC8A6B6E2F7A07EA94A9149C81E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q..b?..b?..b?......b?..>..b?..:..b?..;..b?..<..b?.2.>..b?..>..b?.7.>..b?..b>.pb?.2.2..b?.2.?..b?.2....b?.2.=..b?.Rich.b?.........PE..d.....,d.........." .....P...........<....................................................`............................................P...0............................/......T....k..T............................k..8............`.. ............................text....N.......P.................. ..`.rdata..4P...`...R...T..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158488
Entropy (8bit):	6.8491143497239655
Encrypted:	false
SSDEEP:	3072:j0k3SXjD9aWpAn3rb7SbuDlvNgS4fWqEznfo9mNoFTSlXZ8Ax5ILZ1GIxq:j0kiXjD9v8X7Euk4wYOFTafxn
MD5:	7447EFD8D71E8A1929BE0FAC722B42DC
SHA1:	6080C1B84C2DCBF03DCC2D95306615FF5FCE49A6
SHA-256:	60793C8592193CFBD00FD3E5263BE4315D650BA4F9E4FDA9C45A10642FD998BE
SHA-512:	C6295D45ED6C4F7534C1A38D47DDC55FEA8B9F62BBDC0743E4D22E8AD0484984F8AB077B73E683D0A92D11BF6588A1AE395456CFA57DA94BB2A6C4A1B07984DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l.M...M...M...D..I.......O.......F.......E.......N.......N.......O...M...(.......w.......L.......L.......L...RichM...................PE..d...&.,d.........." .....`..........p3...............................................4....`.............................................L.......x....`.......@.......<.../...p..D...H{..T............................{..8............p...............................text....^.......`.................. ..`.rdata.......p.......d..............@..@.data........0......................@....pdata.......@......................@..@.rsrc........`.......0..............@..@.reloc..D....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34584
Entropy (8bit):	6.41423936733334
Encrypted:	false
SSDEEP:	768:eZt56pxGyC572edLMILWt3u5YiSyvCVPxWElj:eL5PyC572edLMILWt3E7SyqPx3
MD5:	A9A0588711147E01EED59BE23C7944A9
SHA1:	122494F75E8BB083DDB6545740C4FAE1F83970C9
SHA-256:	7581EDEA33C1DB0A49B8361E51E6291688601640E57D75909FB2007B2104FA4C
SHA-512:	6B580F5C53000DB5954DEB5B2400C14CB07F5F8BBCFC069B58C2481719A0F22F0D40854CA640EF8425C498FBAE98C9DE156B5CC04B168577F0DA0C6B13846A88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........sF.. F.. F.. O.k D.. ...!D.. ...!J.. ...!N.. ...!E.. ...!D.. F.. ... ...!C.. ...!D.. ...!G.. ... G.. ...!G.. RichF.. ................PE..d.....,d.........." .........<......0.....................................................`.........................................0D..`....D..x....p.......`.......X.../..........P3..T............................3..8............0...............................text............................... ..`.rdata..L....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49944
Entropy (8bit):	6.381980613434177
Encrypted:	false
SSDEEP:	768:8AM30ie6tyw0lTnj1TulWXaSV2cFVNILXtP5YiSyvWPxWElh7:8AM3hacSV2UNILXth7SyuPxd7
MD5:	FDF8663B99959031780583CCE98E10F5
SHA1:	6C0BAFC48646841A91625D74D6B7D1D53656944D
SHA-256:	2EBBB0583259528A5178DD37439A64AFFCB1AB28CF323C6DC36A8C30362AA992
SHA-512:	A5371D6F6055B92AC119A3E3B52B21E2D17604E5A5AC241C008EC60D1DB70B3CE4507D82A3C7CE580ED2EB7D83BB718F4EDC2943D10CB1D377FA006F4D0026B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........K..%..%..%.....%...$..%... ..%...!..%...&..%...$..%..$...%...$..%...!..%...(..%...%..%......%...'..%.Rich.%.........PE..d.....,d.........." .....>...X...... .....................................................`.........................................0w..X....w.........................../..........`U..T............................U..8............P...............................text....<.......>.................. ..`.rdata..F4...P...6...B..............@..@.data................x..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31512
Entropy (8bit):	6.563116725717513
Encrypted:	false
SSDEEP:	768:bxrUGCpa6rIxdK/rAwVILQU85YiSyvz5PxWEaAc:trUZIzYrAwVILQUG7SydPxDc
MD5:	D8C1B81BBC125B6AD1F48A172181336E
SHA1:	3FF1D8DCEC04CE16E97E12263B9233FBF982340C
SHA-256:	925F05255F4AAE0997DC4EC94D900FD15950FD840685D5B8AA755427C7422B14
SHA-512:	CCC9F0D3ACA66729832F26BE12F8E7021834BBEE1F4A45DA9451B1AA5C2E63126C0031D223AF57CF71FAD2C85860782A56D78D8339B35720194DF139076E0772
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a............................................V...................V......V......V......V......Rich....................PE..d.....,d.........." .........6......................................................N.....`.........................................@C..L....C..d....p.......`.......L.../...........3..T...........................p3..8............0.. ............................text...~........................... ..`.rdata.......0......................@..@.data........P.......8..............@....pdata.......`.......<..............@..@.rsrc........p.......@..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79128
Entropy (8bit):	6.284790077237953
Encrypted:	false
SSDEEP:	1536:ZmtvsXhgzrojAs9/s+S+pGLypbyxk/DDTBVILLwX7SyiPx9:c56OzyAs9/sT+pGLypb+k/XFVILLwX4f
MD5:	819166054FEC07EFCD1062F13C2147EE
SHA1:	93868EBCD6E013FDA9CD96D8065A1D70A66A2A26
SHA-256:	E6DEB751039CD5424A139708475CE83F9C042D43E650765A716CB4A924B07E4F
SHA-512:	DA3A440C94CB99B8AF7D2BC8F8F0631AE9C112BD04BADF200EDBF7EA0C48D012843B4A9FB9F1E6D3A9674FD3D4EB6F0FA78FD1121FAD1F01F3B981028538B666
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~...:...:...:...3.i.<...h...8...h...6...h...2...h...9.......8...:.......q...=.......;.......;.......;.......;...Rich:...........PE..d.....,d.........." .....l...........%.......................................P............`.............................................P............0....... ..<......../...@..........T..............................8............................................text...fj.......l.................. ..`.rdata..Ts.......t...p..............@..@.data...............................@....pdata..<.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	160536
Entropy (8bit):	6.027748879187965
Encrypted:	false
SSDEEP:	3072:OwYiZ+PtocHnVXhLlasuvMETxoEBA+nbUtGnBSonJCNI5ILC7Gax1:FYk+PtocHVxx/uvPCEwhGJ
MD5:	7910FB2AF40E81BEE211182CFFEC0A06
SHA1:	251482ED44840B3C75426DD8E3280059D2CA06C6
SHA-256:	D2A7999E234E33828888AD455BAA6AB101D90323579ABC1095B8C42F0F723B6F
SHA-512:	BFE6506FEB27A592FE9CF1DB7D567D0D07F148EF1A2C969F1E4F7F29740C6BB8CCF946131E65FE5AA8EDE371686C272B0860BD4C0C223195AAA1A44F59301B27
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C.-...-...-.....-...,...-...(...-...)...-.......-.W.,...-.R.,...-...,...-...,...-.W. ...-.W.-...-.W....-.W./...-.Rich..-.................PE..d.....,d.........." ................l*..............................................%.....`.............................................d...........`.......P.......D.../...p..8.......T...............................8............................................text...(........................... ..`.rdata..6...........................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..8....p.......6..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25368
Entropy (8bit):	6.613762885337037
Encrypted:	false
SSDEEP:	384:KYnvEaNKFDyuiBXK55ILZw59HQIYiSy1pCQNuPxh8E9VF0Ny8cIh:FTNK4uyXK55ILZwD5YiSyvEPxWEalh
MD5:	B68C98113C8E7E83AF56BA98FF3AC84A
SHA1:	448938564559570B269E05E745D9C52ECDA37154
SHA-256:	990586F2A2BA00D48B59BDD03D3C223B8E9FB7D7FAB6D414BAC2833EB1241CA2
SHA-512:	33C69199CBA8E58E235B96684346E748A17CC7F03FC068CFA8A7EC7B5F9F6FA90D90B5CDB43285ABF8B4108E71098D4E87FB0D06B28E2132357964B3EEA3A4F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........eG...)...)...)..\|....)..q(...)..q,...)..q-...)..q*...).rq(...)..\|(...)...(...).rq!...).rq)...).rq....).rq+...).Rich..).........PE..d.....,d.........." .........&...... ........................................p.......-....`......................................... )..L...l)..x....P.......@.......4.../...`..<...."..T...........................`"..8............ ..0............................text...X........................... ..`.rdata..f.... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..<....`.......2..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_helpers.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	51712
Entropy (8bit):	5.7041125634129175
Encrypted:	false
SSDEEP:	1536:oeUTOpetu1BFfHNJ+LWdK3E8qVymmc8pMvW5:oRTdUv+LhmEMvW
MD5:	84EFA086513D1DE8B24F453A2DD91B4E
SHA1:	C95E43FAEEAF82222C40A5D47358FCAD8EB0E4C7
SHA-256:	0AC3C91C6DBABD361EBEA7C61469BE7D18F5283AAE2C9A60227E15BB93E83246
SHA-512:	B10023B756341959574556506000CBF33E04305686BE196F0D43408B01532E17664528422A4F08BA5318988A32D003A5746D57C3C7C0C5CAC53C8117E0FF3E41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........oB[..,...,...,..v....,...-...,..v-...,.../...,...(...,...)...,.f{-...,...-...,..$...,..,...,......,......,.Rich..,.........................PE..d....A.g.........." ...).z...T......P\|....................................... ............`.............................................`.......d...................................................................P...@............................................text....x.......z.................. ..`.rdata...5.......6...~..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_http_parser.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	264192
Entropy (8bit):	6.178431284084252
Encrypted:	false
SSDEEP:	6144:7V3pdfjogjEArAZYrbfQvfC4MfNba5bje:7V3HfDEZUbKvMfNbV
MD5:	B1B2574FCF395C0F81100181148F2FC5
SHA1:	5BFC0F84F0AD0E11DCB2227C49C20F404295C5D4
SHA-256:	07C81EA73DD53EFB7BFCE96B3BE5C30A66B5F2481AD4084709EEC651344B46E5
SHA-512:	0EF9B736E5418274A6450101DF53B19F5F3C0919BC3AFAE92414C5CAEEFB4DC3CAF21637552D6DE8973A69E9512A05B10862400FADDF253AC798FB4F2318A86D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...WR..WR..WR...R..WR.kVS..WR.VS..WRj.VS..WR..VRF.WR.kTS..WR.kSS..WR.kRS..WR.j_S..WR.jWS..WR.j.R..WR.jUS..WRRich..WR........................PE..d....A.g.........." ...).,.........../....................................................`.....................................................x....`.......@...............p..\......................................@............@...............................text....+.......,.................. ..`.rdata..^....@.......0..............@..@.data....F..........................@....pdata.......@......................@..@.rsrc........`......................@..@.reloc..\....p......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_http_writer.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.738032375859604
Encrypted:	false
SSDEEP:	768:Vt3vkODNZlemsoR1PBY+m5B1osfQkC++lhnvN7nBlme43w8lWlU2N:VNMOx6FSPBvm7esfdvsvZn6ekRlWDN
MD5:	A3D2A55CAEA54786E254E57D8D4177E0
SHA1:	F75D9067E6CC4E5C21E2AD6322D73492F8E32857
SHA-256:	92E2DBE7E3375156C6A727B34E8B8093966CF4EACAC7F360BE87367665066624
SHA-512:	6221A971D0542381A30E857C76A0DFD45776DFC094CE08D88D7E85EAEC3F59DE41FA972325336600CF427F916059EBE26CCC9189417F599C1DC140876EFC165C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?..............v..............................b{..........4................S...........Rich....................PE..d....A.g.........." ...).v...........x.......................................P............`............................................h...X...d....0....... ..0............@......`............................... ...@...............H............................text....u.......v.................. ..`.rdata...0.......2...z..............@..@.data...(N..........................@....pdata..0.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_websocket.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.597373809979222
Encrypted:	false
SSDEEP:	768:YrQD04NPV+wT4787qUpfuk4HI6cXOcl8BHCWWwGeq:IVEPV9U78T54HrDH5WwGe
MD5:	4EC888267E4CE9402B3F7D33105D7D13
SHA1:	3C151A358704F0E34DE3EDE88041062A62820A18
SHA-256:	411E28F9A3EE60BD4AA8DB7A7EAE3DD19AEB063F3E3C7A8935DF6D0A28624F46
SHA-512:	400F0C26DF99B58E6595D2F3FFBA0BD4BCFCAFCDDFF9D0E9D86C2926C98257A6CB09F147409BF431CB7DB02B6B19A5004AFFDCBDE1D13A1F2F4781965AB0EFA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........oB[..,...,...,..v....,...-...,..v-...,.../...,...(...,...)...,.f{-...,...-.%.,..$...,..,...,......,......,.Rich..,.........................PE..d....A.g.........." ...).N...D......0P....................................................`..........................................\|..d...t\|..d...............4................... s...............................q..@............`...............................text....L.......N.................. ..`.rdata...+...`...,...R..............@..@.data................~..............@....pdata..4...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\attrs-24.2.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI75522\attrs-24.2.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	Unicode text, UTF-8 text, with very long lines (411)
Category:	dropped
Size (bytes):	11524
Entropy (8bit):	5.211520136058075
Encrypted:	false
SSDEEP:	192:ERsUfi6bkQk+k/kKkegToJWicnJsPVA1oz2dv7COmoKTACoEJdQ/0G6lWg+JdQV5:ERsXpLs3VoJWRnJsPvz2dDCHoKsLgA6z
MD5:	49CABCB5F8DA14C72C8C3D00ADB3C115
SHA1:	F575BECF993ECDF9C6E43190C1CB74D3556CF912
SHA-256:	DC9824E25AFD635480A8073038B3CDFE6A56D3073A54E1A6FB21EDD4BB0F207C
SHA-512:	923DAEEE0861611D230DF263577B3C382AE26400CA5F1830EE309BD6737EED2AD934010D61CDD4796618BEDB3436CD772D9429A5BED0A106EF7DE60E114E505C
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: attrs.Version: 24.2.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: GitHub, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Languag

C:\Users\user\AppData\Local\Temp\_MEI75522\attrs-24.2.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	3556
Entropy (8bit):	5.814247636010401
Encrypted:	false
SSDEEP:	96:Q9ewplxJT/oPynEddwBbCobXm9qGmR5VXzskcGD+qLtxO:2ewXdJCKXGeR/XzKiO
MD5:	48C3E62C23B44C5C1B03F2634154C391
SHA1:	7E674C4D1EC604BB62103DBEEB008350FF159EE7
SHA-256:	0B638F04D30B4FF714170AC499F89142868A36760532ED20017263E9CC85136C
SHA-512:	99B720AF1775F6A264C28817E44112CD6422E8716E62221946629D08FA1EC06FFB4E9076E55429CB19A9F07C7E95B2BDC01C6523178E7DFB824841C954ED0C16
Malicious:	false
Preview:	attr/__init__.py,sha256=l8Ewh5KZE7CCY0i1iDfSCnFiUTIkBVoqsXjX9EZnIVA,2087..attr/__init__.pyi,sha256=aTVHBPX6krCGvbQvOl_UKqEzmi2HFsaIVm2WKmAiqVs,11434..attr/__pycache__/__init__.cpython-310.pyc,,..attr/__pycache__/_cmp.cpython-310.pyc,,..attr/__pycache__/_compat.cpython-310.pyc,,..attr/__pycache__/_config.cpython-310.pyc,,..attr/__pycache__/_funcs.cpython-310.pyc,,..attr/__pycache__/_make.cpython-310.pyc,,..attr/__pycache__/_next_gen.cpython-310.pyc,,..attr/__pycache__/_version_info.cpython-310.pyc,,..attr/__pycache__/converters.cpython-310.pyc,,..attr/__pycache__/exceptions.cpython-310.pyc,,..attr/__pycache__/filters.cpython-310.pyc,,..attr/__pycache__/setters.cpython-310.pyc,,..attr/__pycache__/validators.cpython-310.pyc,,..attr/_cmp.py,sha256=3umHiBtgsEYtvNP_8XrQwTCdFoZIX4DEur76N-2a3X8,4123..attr/_cmp.pyi,sha256=U-_RU_UZOyPUEQzXE6RMYQQcjkZRY25wTH99sN0s7MM,368..attr/_compat.py,sha256=n2Uk3c-ywv0PkFfGlvqR7SzDXp4NOhWmNV_ZK6YfWoM,2958..attr/_config.py,sha256=z81Vt-GeT_2taxs1XZfmHx9TWlSxjP

C:\Users\user\AppData\Local\Temp\_MEI75522\attrs-24.2.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.730668933656452
Encrypted:	false
SSDEEP:	3:RtEeXAaCTQnP+tPCCfA5I:Rt2PcnWBB3
MD5:	52ADFA0C417902EE8F0C3D1CA2372AC3
SHA1:	B67635615EEF7E869D74F4813B5DC576104825DD
SHA-256:	D7215D7625CC9AF60AED0613AAD44DB57EBA589D0CCFC3D8122114A0E514C516
SHA-512:	BFA87E7B0E76E544C2108EF40B9FAC8C5FF4327AB8EDE9FEB2891BD5D38FEA117BD9EEBAF62F6C357B4DEADDAD5A5220E0B4A54078C8C2DE34CB1DD5E00F2D62
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: hatchling 1.25.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI75522\attrs-24.2.0.dist-info\licenses\LICENSE

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	5.104415762129373
Encrypted:	false
SSDEEP:	24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
MD5:	5E55731824CF9205CFABEAB9A0600887
SHA1:	243E9DD038D3D68C67D42C0C4BA80622C2A56246
SHA-256:	882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
SHA-512:	21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

C:\Users\user\AppData\Local\Temp\_MEI75522\base_library.zip

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	880569
Entropy (8bit):	5.68298547144186
Encrypted:	false
SSDEEP:	12288:cgYJu4KXWyBC6S4IEa8A4a2Ya2xdOVwx/fpEh+rtSLMN6:cgYJiVBFLa2xTVwx/fpEh++MN6
MD5:	4C60BCC38288ED81C09957FC6B4CD7CD
SHA1:	E7F08D71E567EA73BB30656953837314C8D715A7
SHA-256:	9D6F7B75918990EC9CD5820624130AF309A2045119209BD90B4F70BC3ABD3733
SHA-512:	856D97B81A2CB53DCBA0136AFA0782E0F3F81BEA46F98E0247582B2E28870B837BE3C03E87562B918EC6BC76469EECC2C22599238D191D3FBA467F7031A2ACAA
Malicious:	false
Preview:	PK..........!..,..5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI75522\frozenlist\_frozenlist.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	5.9308989665858585
Encrypted:	false
SSDEEP:	1536:ZmwCw3vZ1w4vI1FxF6S2s0suvV81dvUflo6vp9862WhFo1emYU+:Z/CwxqC+bsNlflo6h93FiemYL
MD5:	911470750962640CEB3FD11E2AEECD14
SHA1:	AF797451D4028841D92F771885CB9D81AFBA3F96
SHA-256:	5C204F6966526AF4DC0C0D6D29909B6F088C4FA781464F2948414D833B03094D
SHA-512:	637043C20DC17FBC472613C0E4F576F0A2211B7916B3488806AEC30271CF1BD84BD790518335B88910662FD4844F8ED39FA75AA278577271A966756B8CD793F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._5..1f..1f..1f.f..1f..0g..1f..0g..1f..4g..1f..5g..1f..2g..1f..0g..1f..0fS.1f.q9g..1f.q1g..1f.q.f..1f.q3g..1fRich..1f........................PE..d.....{e.........." ...%.....t......p.....................................................`.........................................p6..h....6..x............p..4....................&...............................$..@...............(............................text............................... ..`.rdata...I.......J..................@..@.data...P....P.......2..............@....pdata..4....p.......@..............@..@.rsrc................L..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3450648
Entropy (8bit):	6.098075450035195
Encrypted:	false
SSDEEP:	98304:YP+uemAdn67xfxw6rKsK1CPwDv3uFfJz1CmiX:OZemAYxfxw6HK1CPwDv3uFfJzUmA
MD5:	9D7A0C99256C50AFD5B0560BA2548930
SHA1:	76BD9F13597A46F5283AA35C30B53C21976D0824
SHA-256:	9B7B4A0AD212095A8C2E35C71694D8A1764CD72A829E8E17C8AFE3A55F147939
SHA-512:	CB39AA99B9D98C735FDACF1C5ED68A4D09D11F30262B91F6AA48C3F8520EFF95E499400D0CE7E280CA7A90FF6D7141D2D893EF0B33A8803A1CADB28BA9A9E3E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........].q...q...q....M..q.......q.......q.......q.......q...q..[q.......q.......q.......s.......q....!..q.......q..Rich.q..........................PE..d......c.........." ..."..$.................................................. 5......%5...`.........................................../..h...Z4.@.....4.\|.....2......x4../....4..O....-.8.............................-.@............P4..............................text.....$.......$................. ..`.rdata..&.....%.......$.............@..@.data...!z....2..,....1.............@....pdata........2.......2.............@..@.idata..^#...P4..$....3.............@..@.00cfg..u.....4.......3.............@..@.rsrc...\|.....4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\libffi-7.dll

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	704792
Entropy (8bit):	5.5573527806738126
Encrypted:	false
SSDEEP:	12288:WhO7/rNKmrouK/POt6h+7ToRLgo479dQwwLOpWW/dQ0TGqwfU2lvz2:2is/POtrzbLp5dQ0TGqcU2lvz2
MD5:	BEC0F86F9DA765E2A02C9237259A7898
SHA1:	3CAA604C3FFF88E71F489977E4293A488FB5671C
SHA-256:	D74CE01319AE6F54483A19375524AA39D9F5FD91F06CF7DF238CA25E043130FD
SHA-512:	FFBC4E5FFDB49704E7AA6D74533E5AF76BBE5DB297713D8E59BD296143FE5F145FBB616B343EED3C48ECEACCCCC2431630470D8975A4A17C37EAFCC12EDD19F4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1}q.1}q.1}q.8..=}q.~.p.3}q.z.p.3}q.~.t.=}q.~.u.9}q.~.r.5}q...p.2}q.1}p..\|q...u..}q...q.0}q.....0}q...s.0}q.Rich1}q.........PE..d......c.........." ...".D...T......<................................................i....`..........................................A...N..@U..........s........N......./......h.......8...............................@............@..@............................text....B.......D.................. ..`.rdata.../...`...0...H..............@..@.data...AM.......D...x..............@....pdata...V.......X..................@..@.idata..%W...@...X..................@..@.00cfg..u............l..............@..@.rsrc...s............n..............@..@.reloc..q............v..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\multidict\_multidict.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47616
Entropy (8bit):	5.316469446718147
Encrypted:	false
SSDEEP:	768:3Y2vE6F6hmSrnDe651sYEYMXMBkYcE6n0/d3g:oAoVDeWlEEBkYcDni
MD5:	95463F615865A472F75DDB365644A571
SHA1:	91F22EF3F2FFD3E9D6CE6E58BEEA9A96287B090B
SHA-256:	9EE77474D244A17337D4CCC5113FE4AF7B4D86F9969293A884927718D06E63C8
SHA-512:	E3CCCCE9EBF5E7CF33E68046D3E7B59E454CCB791635EB5F405977FD270126EF8B58E6288DBE58C96B681361D81EF28720EBA8D0BD389BFB0F4C3114D098A117
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?............v........................&{................................S.............Rich............PE..d....\|.f.........." ...).\...`......`^....................................................`.............................................d.......d...............................L.......................................@............p...............................text....Z.......\.................. ..`.rdata...,...p.......`..............@..@.data....#..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..L...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\propcache\_helpers_c.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	5.867031753273455
Encrypted:	false
SSDEEP:	1536:AW91laAiAWZ0VEhefLGCUjV3LzATqzPgC9Z:b93MAWiPKCUBXbzPgC
MD5:	41E139669CACB62EE4E06EF7EB1A647E
SHA1:	1FA1274A9F7A0E53458F641C115F7407910E6CB1
SHA-256:	B6FBAC3A2BAA833F34C327BE227A816DF47B11F45AC8A42E7B75C42E90C65353
SHA-512:	98E9810A91C74B2241826D96CAE0B124CD8EACED629B502654C537C8EF7F1D3462ACCFB5BF3FB91069616C9501EB68B6A66F42E51927C3A167E1AD81CC27C8C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?..............v..............................b{...........................S...........Rich....................PE..d......g.........." ...).....l......@........................................p............`.............................................d.......d....P.......@..l............`..T.......................................@............................................text............................... ..`.rdata...E.......F..................@..@.data........ ......................@....pdata..l....@......................@..@.rsrc........P....... ..............@..@.reloc..T....`......."..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\pyarmor_runtime_000000\pyarmor_runtime.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	modified
Size (bytes):	634368
Entropy (8bit):	6.200200567944878
Encrypted:	false
SSDEEP:	6144:UUAzxvOPjVmnc39ZldctO7fUoP/epy57mBTIK24KdJPvtBN1BQgnEIPuVZQckeSm:UUAzJEJmnctjdcg7fUoP28N55nEf8g1
MD5:	55557510BCCE2421BD71ECF0F7ECC9AA
SHA1:	CF3EDB8F51FAC62EC374073AD0A3223691DDC99B
SHA-256:	D227F2184A7EA3AD2765610936CF853F36887508B212D5479EED4F49508246C3
SHA-512:	3F5486F73026E32296F3B52CE7115F97C8C6BC55E78716B85BA7E8C6023105704591F240EF4B00667139570D3AD3206E13E87A197BEC3E2F5975B5771EAAEE3A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".............h..0..........a....................................+......... .........................................].... ..D3...........@...$..............................................(...................(+...............................text...............................`.P`.data...0F... ...H..................@.`..rdata..`....p.......\..............@.`@.pdata...$...@...&..."..............@.0@.xdata...&...p...(...H..............@.0@.bss.....f............................`..edata..]............p..............@.0@.idata..D3... ...4...r..............@.0..CRT....X....`......................@.@..tls.........p......................@.@..reloc..............................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	198936
Entropy (8bit):	6.372446720663998
Encrypted:	false
SSDEEP:	3072:13BAJzkk5dT6F62eqf2A3zVnjIHdAPKReewMP12yGUfT0+SYyWgOmrpjAxvwnVIq:FQg4dT6N5OA3zVnjNed4yGKTKR/
MD5:	1118C1329F82CE9072D908CBD87E197C
SHA1:	C59382178FE695C2C5576DCA47C96B6DE4BBCFFD
SHA-256:	4A2D59993BCE76790C6D923AF81BF404F8E2CB73552E320113663B14CF78748C
SHA-512:	29F1B74E96A95B0B777EF00448DA8BD0844E2F1D8248788A284EC868AE098C774A694D234A00BD991B2D22C2372C34F762CDBD9EC523234861E39C0CA752DCAA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7...sn.Jsn.Jsn.Jz.:J.n.J!..Kqn.J!..K.n.J!..K{n.J!..Kpn.J...Kqn.J8..Kpn.Jsn.J.n.J...Kwn.J...Krn.J..VJrn.J...Krn.JRichsn.J................PE..d.....,d.........." ......................................................................`.........................................p...P................................/...........4..T...........................05..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\python310.dll

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4458776
Entropy (8bit):	6.460390021076921
Encrypted:	false
SSDEEP:	49152:myrXfGIy+Bqk5c5Ad2nwZT3Q6wsV136cR2DZvbK30xLNZcAgVBvcpYcvl1IDWbH3:Uw5tVBlicWdvoDkHUMF7Ph/qe
MD5:	63A1FA9259A35EAEAC04174CECB90048
SHA1:	0DC0C91BCD6F69B80DCDD7E4020365DD7853885A
SHA-256:	14B06796F288BC6599E458FB23A944AB0C843E9868058F02A91D4606533505ED
SHA-512:	896CAA053F48B1E4102E0F41A7D13D932A746EEA69A894AE564EF5A84EF50890514DECA6496E915AAE40A500955220DBC1B1016FE0B8BCDDE0AD81B2917DEA8B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...<...<...<...I...<...Sc..<...I...<...I...<...I...<...D...<...D...<...<...=..+I../<..+I...<..+Ia..<..+I...<..Rich.<..........................PE..d.....,d.........." .....V#..v!...............................................E.....".D...`.........................................`.<.....@.=.\|.....D......`B.......C../....D..t....$.T...........................P.$.8............p#.8............................text...bT#......V#................. ..`.rdata...B...p#..D...Z#.............@..@.data... .....=.......=.............@....pdata.......`B......HA.............@..@PyRuntim`....pD......VC.............@....rsrc.........D......ZC.............@..@.reloc...t....D..v...dC.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\select.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29976
Entropy (8bit):	6.627859470728624
Encrypted:	false
SSDEEP:	768:gUC2hwhVHqOmEVILQG35YiSyvrYPxWEl6:FC2ehVKOmEVILQGp7SyEPxe
MD5:	A653F35D05D2F6DEBC5D34DADDD3DFA1
SHA1:	1A2CEEC28EA44388F412420425665C3781AF2435
SHA-256:	DB85F2F94D4994283E1055057372594538AE11020389D966E45607413851D9E9
SHA-512:	5AEDE99C3BE25B1A962261B183AE7A7FB92CB0CB866065DC9CD7BB5FF6F41CC8813D2CC9DE54670A27B3AD07A33B833EAA95A5B46DAD7763CA97DFA0C1CE54C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!.F.O.F.O.F.O.O...D.O...N.D.O...J.M.O...K.N.O...L.B.O...N.D.O.F.N...O...N.C.O...B.G.O...O.G.O....G.O...M.G.O.RichF.O.................PE..d.....,d.........." .........0......................................................;\....`.........................................`@..L....@..x....p.......`.......F.../......H....2..T............................2..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata.......`.......6..............@..@.rsrc........p.......:..............@..@.reloc..H............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1123608
Entropy (8bit):	5.3853088605790385
Encrypted:	false
SSDEEP:	12288:6mwlRMmuZ63NTQCb5Pfhnzr0ql8L8kcM7IRG5eeme6VZyrIBHdQLhfFE+uQfk:ulRuUZV0m8UMMREtV6Vo4uYQfk
MD5:	81D62AD36CBDDB4E57A91018F3C0816E
SHA1:	FE4A4FC35DF240B50DB22B35824E4826059A807B
SHA-256:	1FB2D66C056F69E8BBDD8C6C910E72697874DAE680264F8FB4B4DF19AF98AA2E
SHA-512:	7D15D741378E671591356DFAAD4E1E03D3F5456CBDF87579B61D02A4A52AB9B6ECBFFAD3274CEDE8C876EA19EAEB8BA4372AD5986744D430A29F50B9CAFFB75D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$z.eJ).eJ).eJ)...).eJ)..K(.eJ)..O(.eJ)..N(.eJ)..I(.eJ)\|.K(.eJ)..K(.eJ).eK).eJ)\|.G(.eJ)\|.J(.eJ)\|..).eJ)\|.H(.eJ)Rich.eJ)........................PE..d.....,d.........." .....B.......... *.......................................@......Q.....`.............................................X............ ..........H......../...0.......`..T........................... a..8............`..x............................text...9A.......B.................. ..`.rdata.......`.......F..............@..@.data...............................@....pdata..H...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75522\yarl\_quoting_c.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\grass.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	95744
Entropy (8bit):	5.987843155161849
Encrypted:	false
SSDEEP:	1536:0xvdW+D03Yh2/DL5jsvblQEgPVw8x7Arz+YAK/2RP:0xvw203Yh2/h8OVJArz+YAK/2RP
MD5:	2CE8C33EF12C8556A50F0BBCCDACB1F7
SHA1:	1C25DDC5CDCAA06735610BAB39C011834BAB1E16
SHA-256:	C77F026E36348610BE60C4BC1FC356CD9EFF381E8B033CCB0E366F0BFE691E54
SHA-512:	98BDD35B4262D8A836DB351919C8BE857B5CB1BD08E9CD1987586DE305FF782E6DE0770000475E9D416C5D28E951EC0634B90E6239A4DD31915D11E4D7A6764B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J..].................K.....E.......K......K......K.................FJ.....FJ.....FJj....FJ.....Rich...........................PE..d......g.........." ...)............P.....................................................`..........................................Y..d...tY..x...............................,....G...............................F..@............ ..h............................text............................... ..`.rdata..`M... ...N..................@..@.data...P7...p.......Z..............@....pdata...............f..............@..@.rsrc................r..............@..@.reloc..,............t..............@..B................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.938875728519838
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	grass.exe
File size:	8'394'086 bytes
MD5:	bde4b588168e995961f49b6cb7576594
SHA1:	1a28c66e77e4a7cea5b2e49d116dd20d3d046120
SHA256:	bedf5dc3e40558fcffb4eee7d9efc20db06a1f77433e0c46d247dd4f2640e6f0
SHA512:	e2fb48085f459e303eadfd6b743aec5dd020f4cd1599b6e4692af10f8247506de7cae233765a3cb77a8dd89ff75beeca3d9777f167cd7b4ad121fceeefb89c05
SSDEEP:	196608:6q2FfGXmGPyDfyGgIPawBdnpkYRM6ipe8u2h:d22yDfDgsac66Cjh
TLSH:	EF8633A1225009D2E4F69638C991C579F6B2BC234392DA8757F87FA33E33B905E36741
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......rh.X6...6...6...}q..1...}q......}q..<...&.W.4...&...?...&...'...&.......}q..1...6.......~.../...~...7...Rich6...........PE..d..

File Icon


Icon Hash:	f0362d2f2b2b8c4a

Static PE Info

General

Entrypoint:	0x14000c320
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x67248094 [Fri Nov 1 07:17:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a06f302f71edd380da3d5bf4a6d94ebd

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F06E8EE36CCh
dec eax
add esp, 28h
jmp 00007F06E8EE32DFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F06E8EE3A58h
test eax, eax
je 00007F06E8EE3493h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F06E8EE3477h
dec eax
cmp ecx, eax
je 00007F06E8EE3486h
xor eax, eax
dec eax
cmpxchg dword ptr [0003820Ch], ecx
jne 00007F06E8EE3460h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F06E8EE3469h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F06E8EE3479h
mov byte ptr [000381F5h], 00000001h
call 00007F06E8EE2BB5h
call 00007F06E8EE3E70h
test al, al
jne 00007F06E8EE3476h
xor al, al
jmp 00007F06E8EE3486h
call 00007F06E8EF237Fh
test al, al
jne 00007F06E8EE347Bh
xor ecx, ecx
call 00007F06E8EE3E80h
jmp 00007F06E8EE345Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000381BCh], 00000000h
mov ebx, ecx
jne 00007F06E8EE34D9h
cmp ecx, 01h
jnbe 00007F06E8EE34DCh
call 00007F06E8EE39CEh
test eax, eax
je 00007F06E8EE349Ah
test ebx, ebx
jne 00007F06E8EE3496h
dec eax
lea ecx, dword ptr [000381A6h]
call 00007F06E8EF2172h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ea14	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x49000	0x3e634	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x46000	0x22d4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x88000	0x768	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3bfb0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3be70	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2d000	0x400	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b110	0x2b200	e9069e99481418d9e681710a5e65ed17	False	0.5452728713768116	data	6.496015168861512	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0x1282a	0x12a00	5fa58115f98129f7f385b187f0077746	False	0.5233719588926175	data	5.766657473020416	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x40000	0x5408	0xe00	aff56347f897785154c53727472c548d	False	0.13504464285714285	data	1.8315705466577277	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x46000	0x22d4	0x2400	a913f5d0501c0c45f31faa2f4229aef1	False	0.4764539930555556	data	5.355998213989185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x49000	0x3e634	0x3e800	76a626aa6b0fa6c9984fd79e3adcc0f2	False	0.03837109375	data	1.4508693364120127	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x88000	0x768	0x800	42d6242177dbae8e11ed5d64b87d0d48	False	0.5576171875	data	5.268722219019965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x490e8	0x3e028	Device independent bitmap graphic, 240 x 512 x 32, image size 245760, resolution 11339 x 11339 px/m	0.03509559356200195
RT_GROUP_ICON	0x87110	0x14	data	1.2
RT_MANIFEST	0x87124	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	TranslateMessage, ShutdownBlockReasonCreate, GetWindowThreadProcessId, SetWindowLongPtrW, GetWindowLongPtrW, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, CreateWindowExW, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, GetMessageW
KERNEL32.dll	GetTimeZoneInformation, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, GetStringTypeW, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, CreateDirectoryW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, HeapSize, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, GetCurrentProcessId, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, GetConsoleWindow, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, GetFileAttributesExW, HeapReAlloc, WriteConsoleW, SetEndOfFile, GetDriveTypeW, IsDebuggerPresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, GetModuleHandleW, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, GetCommandLineA, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetCurrentDirectoryW, FlushFileBuffers, SetEnvironmentVariableW
ADVAPI32.dll	ConvertSidToStringSidW, GetTokenInformation, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 17:24:17.036752939 CET	50403	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 17:24:17.036752939 CET	192.168.2.7	1.1.1.1	0x8b69	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 17:24:17.173465014 CET	1.1.1.1	192.168.2.7	0x8b69	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 17:24:18.129615068 CET	1.1.1.1	192.168.2.7	0xe649	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 17:24:18.129615068 CET	1.1.1.1	192.168.2.7	0xe649	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:24:21
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\grass.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\grass.exe"
Imagebase:	0x7ff69e190000
File size:	8'394'086 bytes
MD5 hash:	BDE4B588168E995961F49B6CB7576594
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	11:24:21
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:24:22
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\grass.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\grass.exe"
Imagebase:	0x7ff69e190000
File size:	8'394'086 bytes
MD5 hash:	BDE4B588168E995961F49B6CB7576594
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	11:24:23
Start date:	20/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff68e7c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00007FF69E197E40 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF69E1988F0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF69E193A24,00000000,00007FF69E191965), ref: 00007FF69E198929

SetConsoleCtrlHandler.KERNEL32(FFFFFFFF,00000000,?,00007FF69E1933B4), ref: 00007FF69E197E9B
GetStartupInfoW.KERNEL32 ref: 00007FF69E197EB6

Part of subcall function 00007FF69E1AB324: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1AB338

Part of subcall function 00007FF69E1A95F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A965F

GetCommandLineW.KERNEL32 ref: 00007FF69E197F46
CreateProcessW.KERNELBASE ref: 00007FF69E197F7E
GetLastError.KERNEL32 ref: 00007FF69E197F88

Part of subcall function 00007FF69E192310: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF69E192AC6,?,00007FF69E192BC5), ref: 00007FF69E192360
Part of subcall function 00007FF69E192310: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF69E192AC6,?,00007FF69E192BC5), ref: 00007FF69E19241A

RegisterClassW.USER32 ref: 00007FF69E197FE0
GetLastError.KERNEL32 ref: 00007FF69E197FEB
CreateWindowExW.USER32 ref: 00007FF69E198035
GetLastError.KERNEL32 ref: 00007FF69E198047
WaitForSingleObject.KERNEL32 ref: 00007FF69E198062
GetLastError.KERNEL32 ref: 00007FF69E198075
PeekMessageW.USER32 ref: 00007FF69E198099
TranslateMessage.USER32 ref: 00007FF69E1980A7
DispatchMessageW.USER32 ref: 00007FF69E1980B1
PeekMessageW.USER32 ref: 00007FF69E1980CC
WaitForSingleObject.KERNEL32 ref: 00007FF69E1980DE
WaitForSingleObject.KERNEL32 ref: 00007FF69E1980F9
TerminateProcess.KERNEL32 ref: 00007FF69E19810F
GetLastError.KERNEL32 ref: 00007FF69E198119
WaitForSingleObject.KERNEL32 ref: 00007FF69E198127
DestroyWindow.USER32 ref: 00007FF69E198264
GetExitCodeProcess.KERNEL32 ref: 00007FF69E198279
CloseHandle.KERNEL32 ref: 00007FF69E198282
CloseHandle.KERNEL32 ref: 00007FF69E19828F

Strings

PyInstallerOnefileHiddenWindow, xrefs: 00007FF69E197FB4
CreateProcessW, xrefs: 00007FF69E197F97
PyInstaller Onefile Hidden Window, xrefs: 00007FF69E197FF5
Failed to create child process!, xrefs: 00007FF69E197F90

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: ErrorLastMessage$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 4208240515-3165540532
Opcode ID: 2474af0ddb72a9897968d95ac05e16437d107bcda55c49da42d44140ff8ab908
Instruction ID: e8ebb39b29636f8d5c603f87cd23d65b050840fcafc6584113a2bb7d04a5b8c9
Opcode Fuzzy Hash: 2474af0ddb72a9897968d95ac05e16437d107bcda55c49da42d44140ff8ab908
Instruction Fuzzy Hash: 23D16372E08A8296FB249F74E8902AD3760FFA4758F440276FA5D867A9DF3CD145C720

Function 00007FF69E1B6E10 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF69E1B6E55

Part of subcall function 00007FF69E1B67A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B67BC

Part of subcall function 00007FF69E1AB404: RtlFreeHeap.NTDLL(?,?,?,00007FF69E1B3F32,?,?,?,00007FF69E1B3F6F,?,?,00000000,00007FF69E1B4435,?,?,?,00007FF69E1B4367), ref: 00007FF69E1AB41A
Part of subcall function 00007FF69E1AB404: GetLastError.KERNEL32(?,?,?,00007FF69E1B3F32,?,?,?,00007FF69E1B3F6F,?,?,00000000,00007FF69E1B4435,?,?,?,00007FF69E1B4367), ref: 00007FF69E1AB424

Part of subcall function 00007FF69E1AB7E4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF69E1AB7C3,?,?,?,?,?,00007FF69E1AB6AE), ref: 00007FF69E1AB7ED
Part of subcall function 00007FF69E1AB7E4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF69E1AB7C3,?,?,?,?,?,00007FF69E1AB6AE), ref: 00007FF69E1AB812

_get_daylight.LIBCMT ref: 00007FF69E1B6E44

Part of subcall function 00007FF69E1B6808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B681C

_get_daylight.LIBCMT ref: 00007FF69E1B70BA
_get_daylight.LIBCMT ref: 00007FF69E1B70CB
_get_daylight.LIBCMT ref: 00007FF69E1B70DC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF69E1B731C), ref: 00007FF69E1B7103

Strings

Eastern Summer Time, xrefs: 00007FF69E1B71C1
Eastern Standard Time, xrefs: 00007FF69E1B71A9

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 828acdfc2d062c2bba75013f4106a30f03ee3c50c626b9d1fde7b9e701faf5c7
Instruction ID: 813c5f76ce70dd705817a88c553c26484a4b01c38f3f199cd6cc3abc5e62032e
Opcode Fuzzy Hash: 828acdfc2d062c2bba75013f4106a30f03ee3c50c626b9d1fde7b9e701faf5c7
Instruction Fuzzy Hash: 7ED1AF26E0824286EB30AF26D8C15B967A1EF74794F484176FA0DC7799DF3CE881C760

Function 00007FF69E1B7B74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF69E1B78A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B78E9
Part of subcall function 00007FF69E1B78A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B7967
Part of subcall function 00007FF69E1B78A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B79B8

CreateFileW.KERNELBASE ref: 00007FF69E1B7C7A
CreateFileW.KERNEL32 ref: 00007FF69E1B7CCA
GetLastError.KERNEL32 ref: 00007FF69E1B7CFA
GetFileType.KERNELBASE ref: 00007FF69E1B7D0F
GetLastError.KERNEL32 ref: 00007FF69E1B7D19
CloseHandle.KERNEL32 ref: 00007FF69E1B7D4C
CloseHandle.KERNEL32 ref: 00007FF69E1B7EAF
CreateFileW.KERNEL32 ref: 00007FF69E1B7EE4
GetLastError.KERNEL32 ref: 00007FF69E1B7EF3

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 6900b12a6c6c443aa41c68e268e6275e38d412fb7e8bb922b7a0c5fbdd2459d5
Instruction ID: d188ba02dc684ec1d486227a47d4799b605f5a00b0fd577e40c4c05f8d2b96b3
Opcode Fuzzy Hash: 6900b12a6c6c443aa41c68e268e6275e38d412fb7e8bb922b7a0c5fbdd2459d5
Instruction Fuzzy Hash: B2C1B136F28A4286EB24CF68D4D06BC3761EB59BA8B055375EE1E9B798CF38D055C310

Function 00007FF69E1B708C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF69E1B70BA

Part of subcall function 00007FF69E1B6808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B681C

_get_daylight.LIBCMT ref: 00007FF69E1B70CB

Part of subcall function 00007FF69E1B67A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B67BC

_get_daylight.LIBCMT ref: 00007FF69E1B70DC

Part of subcall function 00007FF69E1B67D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B67EC

Part of subcall function 00007FF69E1AB404: RtlFreeHeap.NTDLL(?,?,?,00007FF69E1B3F32,?,?,?,00007FF69E1B3F6F,?,?,00000000,00007FF69E1B4435,?,?,?,00007FF69E1B4367), ref: 00007FF69E1AB41A
Part of subcall function 00007FF69E1AB404: GetLastError.KERNEL32(?,?,?,00007FF69E1B3F32,?,?,?,00007FF69E1B3F6F,?,?,00000000,00007FF69E1B4435,?,?,?,00007FF69E1B4367), ref: 00007FF69E1AB424

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF69E1B731C), ref: 00007FF69E1B7103

Strings

Eastern Summer Time, xrefs: 00007FF69E1B71C1
Eastern Standard Time, xrefs: 00007FF69E1B71A9

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 2b998ea362c828b2007ff439a7748e19cf2a99d5eecceb3216e2a1cfd4308c36
Instruction ID: 860dec337d116466b263209420a96ba06c6178a38489dd50c0a46a3181818ed0
Opcode Fuzzy Hash: 2b998ea362c828b2007ff439a7748e19cf2a99d5eecceb3216e2a1cfd4308c36
Instruction Fuzzy Hash: C6518336E1864286E730DF22E8C15A967A1FB68784F4841B6FA4DC7799DF3CE441C760

Function 00007FF69E1987E0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF69E198813
FindClose.KERNELBASE ref: 00007FF69E198822

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: bf04df12ed89424385b35bc97b9e30209b4e9d30cb3ee9ccc1531a0517fd62e7
Instruction ID: 6d5c183bf86fe30d3a90fde70c2eccabb46cb81ed2faf2ca9a97094eaff7809d
Opcode Fuzzy Hash: bf04df12ed89424385b35bc97b9e30209b4e9d30cb3ee9ccc1531a0517fd62e7
Instruction Fuzzy Hash: DEF0C226A1C64686F7B08B64F4C876A7390FB94764F04433AFA6E426D4DF3CD049CB10

Function 00007FF69E1B1AD8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: fc28bc5142024d2d55957d51276caef64a2a7d0988b027907db8698371d14740
Instruction ID: 27060c46f0d37ecef57542fe50fdc826aceb55f9026fb79a3551d4fe4ebdf982
Opcode Fuzzy Hash: fc28bc5142024d2d55957d51276caef64a2a7d0988b027907db8698371d14740
Instruction Fuzzy Hash: EE02B021F0DA4280FA79AB16A4C42791694EF25BA0F4A46B5FD5EC73DADE3CE4458330

Function 00007FF69E191000 Relevance: 61.8, APIs: 3, Strings: 32, Instructions: 529COMMON

Download Yara Rule

Strings

Failed to remove temporary directory: %s, xrefs: 00007FF69E193404
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF69E193302
MEI, xrefs: 00007FF69E192CF3
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF69E192D9E
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF69E193250
VCRUNTIME140.dll, xrefs: 00007FF69E1931F7
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF69E192D31
pyi-contents-directory, xrefs: 00007FF69E192F58
minimize-early, xrefs: 00007FF69E192FAE
_PYI_ARCHIVE_FILE, xrefs: 00007FF69E192C92, 00007FF69E192DC0
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF69E1932ED
minimize-late, xrefs: 00007FF69E192FE8
Py_GIL_DISABLED, xrefs: 00007FF69E192EBE
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF69E1930A5
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF69E193043
_PYI_SPLASH_IPC, xrefs: 00007FF69E192DE4, 00007FF69E19333C
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF69E192DD8, 00007FF69E192DF0, 00007FF69E192E5C
hide-early, xrefs: 00007FF69E192F91
pkg, xrefs: 00007FF69E192D7E
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF69E193158
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF69E192EFC
Failed to load splash screen resources!, xrefs: 00007FF69E1932CC
hide-late, xrefs: 00007FF69E192FCB
pyi-runtime-tmpdir, xrefs: 00007FF69E192F33
pyi-python-flag, xrefs: 00007FF69E192EA0
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF69E192C43, 00007FF69E192C6F
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF69E192DCC, 00007FF69E19311A, 00007FF69E1933A0
Failed to convert DLL search path!, xrefs: 00007FF69E193222
pyi-hide-console, xrefs: 00007FF69E192F7D
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF69E19317B
Failed to start splash screen!, xrefs: 00007FF69E19331B
Could not create temporary directory!, xrefs: 00007FF69E193105

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$hide-early$hide-late$minimize-early$minimize-late$pkg$pyi-contents-directory$pyi-hide-console$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-3325264605
Opcode ID: 9ae7f750cbda2c6fe1b289ef93cae490ad94cd4c015a3c7c99c46b277af9807d
Instruction ID: 20d76ad72b4621590f020c6df664e0134a8dfc8d53bc4db9112961887c4279a3
Opcode Fuzzy Hash: 9ae7f750cbda2c6fe1b289ef93cae490ad94cd4c015a3c7c99c46b277af9807d
Instruction Fuzzy Hash: C0424F21E0C68291FB399B21B4D52F96691EF75784F8840B2F95EC62D6EF2CE549C320

Function 00007FF69E191930 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF69E1973F0: _fread_nolock.LIBCMT ref: 00007FF69E19749A

_fread_nolock.LIBCMT ref: 00007FF69E1919FB

Part of subcall function 00007FF69E192020: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF69E191B4A), ref: 00007FF69E192070

Strings

Failed to read cookie!, xrefs: 00007FF69E191A0B
Could not read full TOC!, xrefs: 00007FF69E191B35
Failed to seek to cookie position!, xrefs: 00007FF69E1919CE
Could not allocate buffer for TOC!, xrefs: 00007FF69E191AFB
MEI, xrefs: 00007FF69E191971
fseek, xrefs: 00007FF69E1919D5
Error on file., xrefs: 00007FF69E191B6D
calloc, xrefs: 00007FF69E191A48
fread, xrefs: 00007FF69E191A12, 00007FF69E191B3C
malloc, xrefs: 00007FF69E191B02
Could not allocate memory for archive structure!, xrefs: 00007FF69E191A41

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: d342bd050b80ae67081b8d09b78cfe586e9a3ccb02bac190d8dffc1f5b2289e7
Instruction ID: 2d69f020cdce0ad996588d4f8f1ae6404505359ceeb2cca558552a3bd21b289f
Opcode Fuzzy Hash: d342bd050b80ae67081b8d09b78cfe586e9a3ccb02bac190d8dffc1f5b2289e7
Instruction Fuzzy Hash: 6D816E71B0968295EB789B24E0C43B923A1FF68784F444076F98EC7799DE3CE5858760

Function 00007FF69E1915E0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open target file!, xrefs: 00007FF69E19163C
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF69E1916BA
fseek, xrefs: 00007FF69E1916C1
Failed to create symbolic link %s!, xrefs: 00007FF69E191602
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF69E1917BF
fopen, xrefs: 00007FF69E191643
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF69E191722
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF69E1917AA
fread, xrefs: 00007FF69E1917C6
malloc, xrefs: 00007FF69E191729
fwrite, xrefs: 00007FF69E1917B1
Failed to extract %s: failed to open archive file!, xrefs: 00007FF69E191682

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 309e4027ca95412ee9faba42603f6b5579a7da6b534e83076e499c3a5127f610
Instruction ID: 582c1d607a9cec01a9258ab3920dad221f1efb19a7aa0152815412f0e1f0bc8a
Opcode Fuzzy Hash: 309e4027ca95412ee9faba42603f6b5579a7da6b534e83076e499c3a5127f610
Instruction Fuzzy Hash: C2517D61F0864392FA38AB25B4902B96391FF64794F8841B2FE1D87796DF3CE595C320

Function 00007FF69E197AC0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(FFFFFFFF,00000000,?,00007FF69E193101), ref: 00007FF69E197B64
GetCurrentProcessId.KERNEL32(?,00007FF69E193101), ref: 00007FF69E197B6A
CreateDirectoryW.KERNELBASE(?,00007FF69E193101), ref: 00007FF69E197BAC

Part of subcall function 00007FF69E197C90: GetEnvironmentVariableW.KERNEL32(00007FF69E192C4F), ref: 00007FF69E197CC7
Part of subcall function 00007FF69E197C90: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF69E197CE9

Part of subcall function 00007FF69E1A9114: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A912D

Strings

_MEI%d, xrefs: 00007FF69E197B72
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF69E197BDE
TMP, xrefs: 00007FF69E197AFC, 00007FF69E197C03
LOADER: failed to set the TMP environment variable., xrefs: 00007FF69E197B3C
TMP, xrefs: 00007FF69E197B22

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandPathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 365913792-1339014028
Opcode ID: 2e52d3a269ba2fba32a796f721e029391d2490e1255413ade70f9a334cfbb104
Instruction ID: 2f899ee456f5af8910dd103f0980fada7f89c7e42d15ee693dd5060d565c332f
Opcode Fuzzy Hash: 2e52d3a269ba2fba32a796f721e029391d2490e1255413ade70f9a334cfbb104
Instruction Fuzzy Hash: E4418F21F1D64252FA34EB25E8D52F96291FF68B90F8440B1FD0EC7796DE3CE5458260

Function 00007FF69E1911F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF69E19129A
1.3.1, xrefs: 00007FF69E191229
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF69E191256
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF69E1913FE
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF69E1912CF
malloc, xrefs: 00007FF69E1912A1, 00007FF69E1912D6

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 0b06fb82d533cb4ecd4f46c144013089fd3ee3de2826cfc27ffae7048b7c178b
Instruction ID: 5f24e14aa1e1b619edb470d4464151d3af3cdc3853ec66c01bb5db9ece5c4cc3
Opcode Fuzzy Hash: 0b06fb82d533cb4ecd4f46c144013089fd3ee3de2826cfc27ffae7048b7c178b
Instruction Fuzzy Hash: 9651E122B0868241EA78AB11B4803BA62A1FFA57A4F484175FD4DC7BC5EF3CE585C720

Function 00007FF69E192A70 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF69E192BC5), ref: 00007FF69E192AA1
GetLastError.KERNEL32(?,00007FF69E192BC5), ref: 00007FF69E192AAB

Part of subcall function 00007FF69E192310: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF69E192AC6,?,00007FF69E192BC5), ref: 00007FF69E192360
Part of subcall function 00007FF69E192310: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF69E192AC6,?,00007FF69E192BC5), ref: 00007FF69E19241A

Strings

Failed to obtain executable path., xrefs: 00007FF69E192AB3
Failed to resolve full path to executable %ls., xrefs: 00007FF69E192AF9
\\?\, xrefs: 00007FF69E192B1A
Failed to convert executable path to UTF-8., xrefs: 00007FF69E192B50
GetModuleFileNameW, xrefs: 00007FF69E192ABA

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentErrorFileFormatLastMessageModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 4002088556-2863816727
Opcode ID: aed140f8d8e2637361ba54921802919f4f3b7eb641456186ceb893f60fbbd120
Instruction ID: 573240ce2c2d56d649bc6abb3620cdb0e0dfc17d8a6449be81371fe29533e2b5
Opcode Fuzzy Hash: aed140f8d8e2637361ba54921802919f4f3b7eb641456186ceb893f60fbbd120
Instruction Fuzzy Hash: 52217F21F1864691FB749B21F8853BA2394FFA8794F8001B2F55EC66E9EE2CE505C724

Function 00007FF69E1AC8FC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1ACD29

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 80356c07d7716e3a33c0607b4436fae4fe86914692bbbcb11f6e9f741b23577c
Instruction ID: 916c05f46c9f49f610706a61eefaca6229687c7fa24c08b119aedc524c1ab6f5
Opcode Fuzzy Hash: 80356c07d7716e3a33c0607b4436fae4fe86914692bbbcb11f6e9f741b23577c
Instruction Fuzzy Hash: 49C1E122A4C78291E7708B1594842BD3B99FFA1BE0F5941B1FA4E83791DF7DE84D8320

Function 00007FF69E1979D0 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF69E1979F0
OpenProcessToken.ADVAPI32 ref: 00007FF69E197A03
GetTokenInformation.KERNELBASE ref: 00007FF69E197A28
GetLastError.KERNEL32 ref: 00007FF69E197A32
GetTokenInformation.KERNELBASE ref: 00007FF69E197A72
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF69E197A8E
CloseHandle.KERNELBASE ref: 00007FF69E197AA6

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 2dbe312e9bad51c5a347f8555ec24f0658a64836a3ba09d3ac23aad2f9ca70f7
Instruction ID: 07247fabcd9947f17e70951a10ea1753b425517c27480a277b1d826e30f1b5d8
Opcode Fuzzy Hash: 2dbe312e9bad51c5a347f8555ec24f0658a64836a3ba09d3ac23aad2f9ca70f7
Instruction Fuzzy Hash: 3A215131E0C64282EA249B55F4C023AA3A1FFA57A0F180675FAAC87BE8DF6CD5558710

Function 00007FF69E1985D0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF69E1979D0: GetCurrentProcess.KERNEL32 ref: 00007FF69E1979F0
Part of subcall function 00007FF69E1979D0: OpenProcessToken.ADVAPI32 ref: 00007FF69E197A03
Part of subcall function 00007FF69E1979D0: GetTokenInformation.KERNELBASE ref: 00007FF69E197A28
Part of subcall function 00007FF69E1979D0: GetLastError.KERNEL32 ref: 00007FF69E197A32
Part of subcall function 00007FF69E1979D0: GetTokenInformation.KERNELBASE ref: 00007FF69E197A72
Part of subcall function 00007FF69E1979D0: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF69E197A8E
Part of subcall function 00007FF69E1979D0: CloseHandle.KERNELBASE ref: 00007FF69E197AA6

LocalFree.KERNEL32(00000000,00007FF69E193099), ref: 00007FF69E19865C
LocalFree.KERNEL32 ref: 00007FF69E198665

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF69E198673
D:(A;;FA;;;%s), xrefs: 00007FF69E198647
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF69E198632
S-1-3-4, xrefs: 00007FF69E198611

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: f26ec0dcd69835f1fdfab6917ff37eee5f64ab48aaa57a2c57790bee01b0605b
Instruction ID: 9cb132cbf4c113a26937366a41c51570035f46dcd734d439742ad5d6cffb13a1
Opcode Fuzzy Hash: f26ec0dcd69835f1fdfab6917ff37eee5f64ab48aaa57a2c57790bee01b0605b
Instruction Fuzzy Hash: 8E218231E0874291F664AB10F8853EA6351FFA8780F444076FA4E97796DF3CD544C760

Function 00007FF69E197280 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF69E1928EC,FFFFFFFF,00000000,00007FF69E19336A), ref: 00007FF69E197392

Strings

\, xrefs: 00007FF69E1972F7
%s%c, xrefs: 00007FF69E197304
%.*s, xrefs: 00007FF69E19734B

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 8e574211d35a3454bd1f80bb928e77a822a66f29249788f56d1187a589c5086b
Instruction ID: e4c00158b9fc8b71af9fb3c49f0d97510401c8389067f31663fabd7582d0ec40
Opcode Fuzzy Hash: 8e574211d35a3454bd1f80bb928e77a822a66f29249788f56d1187a589c5086b
Instruction Fuzzy Hash: 9131C821B19AC585EA319B21F8907FA6354EF64BE0F444271FEAD877C9DF2CD2458720

Function 00007FF69E1ADE00 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69E1ADDEB), ref: 00007FF69E1ADF1C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69E1ADDEB), ref: 00007FF69E1ADFA7

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: b1b3b8c023f7ba687af61716d2192fb8b78e81e0c789d7bf84049ae76950eea3
Instruction ID: abd8d3f4ad9fbfeee6452d04125e30808b7cfa1b067ed0abcd2f48ec8d5de8e3
Opcode Fuzzy Hash: b1b3b8c023f7ba687af61716d2192fb8b78e81e0c789d7bf84049ae76950eea3
Instruction Fuzzy Hash: AB91A362F48A5185F7709F6594C03BD2BA0FB64BACF1441B9EE0E97685DF38D48AC320

Function 00007FF69E1B0B9C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF69E1B0C8C
_get_daylight.LIBCMT ref: 00007FF69E1B0C9D
_get_daylight.LIBCMT ref: 00007FF69E1B0CAE
_isindst.LIBCMT ref: 00007FF69E1B0D79

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 2e6031cc300e1475187715cca5cdabb73b1d07b9bdc859d286f3c4b7aef44358
Instruction ID: b8ff684ad1d51848f6c7bfd5755aa82884d88d53649b369e382567a2f4dea23b
Opcode Fuzzy Hash: 2e6031cc300e1475187715cca5cdabb73b1d07b9bdc859d286f3c4b7aef44358
Instruction Fuzzy Hash: 2E510372F14212CAEB34DF65D9D56BC27A1EB20358F580279FD1E92BE8DF38A5428710

Function 00007FF69E1A66D8 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF69E1A670B
GetFileInformationByHandle.KERNELBASE ref: 00007FF69E1A676D
GetLastError.KERNEL32 ref: 00007FF69E1A67FE
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69E1A6610), ref: 00007FF69E1A684A

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 7aea2cec07b43bd3a62d7cb92d6e4f171015a752618fb1c816dd601643431e78
Instruction ID: a4b99929a05b1363b9da7f3ac5dc4578883b3de9b461f27a8552aa54551856a8
Opcode Fuzzy Hash: 7aea2cec07b43bd3a62d7cb92d6e4f171015a752618fb1c816dd601643431e78
Instruction Fuzzy Hash: D4519222E186418AF724CFB0D4803BD33A5EF64B68F154574EE0E97648DF38D489C760

Function 00007FF69E1A6584 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A65B1
CreateFileW.KERNELBASE ref: 00007FF69E1A65F0
CloseHandle.KERNEL32 ref: 00007FF69E1A6625

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 615a019661923f18b870c88d8c8c2e3de58a1ea0c3f5553ccf0a12bc46e2c946
Instruction ID: 972609c09b9ddc3f1ffd108bbdd87e9af2ca35b4acaad9bf9a05c08f5190d361
Opcode Fuzzy Hash: 615a019661923f18b870c88d8c8c2e3de58a1ea0c3f5553ccf0a12bc46e2c946
Instruction Fuzzy Hash: BA41A162E1878283E7649B2195903797260FFB5764F109374F66C83AD6DF7CE4E48720

Function 00007FF69E19F634 Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E19F678
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E19F76F

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 919e35f825c4b2d0c47f1daa14334d7665f7d6761e0e1dfe6f75020668a0049a
Instruction ID: 1be00c53b70dbf55f9fb0da38f5a166946e9329541ed1591f933b121ae1f373c
Opcode Fuzzy Hash: 919e35f825c4b2d0c47f1daa14334d7665f7d6761e0e1dfe6f75020668a0049a
Instruction Fuzzy Hash: F3510821F09B8296FA789E25A48067A6291FF68BB4F144774FD7C877D9CF3CE4418620

Function 00007FF69E19C19C Relevance: 3.1, APIs: 2, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E19C37C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF69E19C390

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF69E19C1C5
__scrt_release_startup_lock.LIBCMT ref: 00007FF69E19C233

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 1236291503-0
Opcode ID: 0062f537d7c131bdaaf4aef5eb59421e6e9ee6bfc8727e8bca4d357a962c4ab6
Instruction ID: dc87d0d1e768ca5f01d2cefcf49844a80befc7fc0432e0402bb41aadc727254f
Opcode Fuzzy Hash: 0062f537d7c131bdaaf4aef5eb59421e6e9ee6bfc8727e8bca4d357a962c4ab6
Instruction Fuzzy Hash: 04311B21E4C20342FA74ABA5A4D13B91291EFA5784F4440B5FA8DCB7D7DE2CB4448671

Function 00007FF69E1AD2B8 Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF69E1AD331
GetFileType.KERNELBASE ref: 00007FF69E1AD347

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 336ff322d096320c7609ad2a1ebfb1af701ecd8db59b0b6a36a9cc413741d25d
Instruction ID: 08485d938d39b7223dce87a1134b404a4e4fa376a58007fb0efd60f92f524b86
Opcode Fuzzy Hash: 336ff322d096320c7609ad2a1ebfb1af701ecd8db59b0b6a36a9cc413741d25d
Instruction Fuzzy Hash: 2531B362A18F4581EB348B1585D027C6650FF65BB4F6903B9EB6E873E0CF38E4A5C310

Function 00007FF69E1ACFD4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF69E1ACFC0,?,?,?,00000000,?,00007FF69E1AD0C9), ref: 00007FF69E1AD020
GetLastError.KERNEL32(?,?,?,?,?,00007FF69E1ACFC0,?,?,?,00000000,?,00007FF69E1AD0C9), ref: 00007FF69E1AD02A

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: c8d9032d6f18d1acbd55ff3d5784a6e8b9f1708e95d0104a6ada3112851001ef
Instruction ID: 543f56c799c393360bac886190e69c6aee036643aa23b23035274b0bf5596ae3
Opcode Fuzzy Hash: c8d9032d6f18d1acbd55ff3d5784a6e8b9f1708e95d0104a6ada3112851001ef
Instruction Fuzzy Hash: A611C461A08B4181DA208B25F58417D6361EB54BF4F540771FE7D8B7D9CF7CD0558704

Function 00007FF69E1A6880 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69E1A6795), ref: 00007FF69E1A68B3
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69E1A6795), ref: 00007FF69E1A68C9

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 3a94ee504119d0a5112130d15b8324ff604b1d1e2425208ec9014ecb5db7cc3c
Instruction ID: 6132af5755202f9644e71be222681d4778315cd74f8b49e077f8d86519a56395
Opcode Fuzzy Hash: 3a94ee504119d0a5112130d15b8324ff604b1d1e2425208ec9014ecb5db7cc3c
Instruction Fuzzy Hash: B111A331A0C65681EB748B11A48113EB760FB95771F51027AFA9EC1AE8EF7CD048CB10

Function 00007FF69E1AB404 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF69E1B3F32,?,?,?,00007FF69E1B3F6F,?,?,00000000,00007FF69E1B4435,?,?,?,00007FF69E1B4367), ref: 00007FF69E1AB41A
GetLastError.KERNEL32(?,?,?,00007FF69E1B3F32,?,?,?,00007FF69E1B3F6F,?,?,00000000,00007FF69E1B4435,?,?,?,00007FF69E1B4367), ref: 00007FF69E1AB424

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 0e9bd81d70d272d571b15e7d509907a6bc8aa23799849ce19584cafaa201c9c5
Instruction ID: 8fadb2bb18ef992cef606f2fe410f866240c901eee22bf2c8df04c646928ebb3
Opcode Fuzzy Hash: 0e9bd81d70d272d571b15e7d509907a6bc8aa23799849ce19584cafaa201c9c5
Instruction Fuzzy Hash: 2EE0EC90F4D64282FF396BF298D91782591DFB8760B4844B4F90ED7366DF2CA8898330

Function 00007FF69E1ABA00 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF69E1AB87D,?,?,00000000,00007FF69E1AB932), ref: 00007FF69E1ABA6E
GetLastError.KERNEL32(?,?,?,00007FF69E1AB87D,?,?,00000000,00007FF69E1AB932), ref: 00007FF69E1ABA78

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 77e2bcd66fe63b7e32e9c420d5456187ea64b38b498190725808e49f9c0985ab
Instruction ID: b009b451a414f05f670a56cba398d0f7075b6ebfa9906927bb8137a733417eb8
Opcode Fuzzy Hash: 77e2bcd66fe63b7e32e9c420d5456187ea64b38b498190725808e49f9c0985ab
Instruction Fuzzy Hash: AE219F61F4868241FE746B25A4D92BD1281DFA47B0F0442B5FA2ECB3D2DE6CE4C94320

Function 00007FF69E1ACD4C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1ACD74

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cef91153d0287460df793cf75ca837be229cde64a0ee5071419af57252f7b7cb
Instruction ID: 40202bdea925d03a5a4d5c8ad722f144feb6d2391889fb6b8d97333ca5afc71d
Opcode Fuzzy Hash: cef91153d0287460df793cf75ca837be229cde64a0ee5071419af57252f7b7cb
Instruction Fuzzy Hash: 3A41A232A4864187EA34DB19E5802B97BA4EF76BA0F140171E78EC76D1CF3CE446C761

Function 00007FF69E1973F0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF69E19749A

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: bc451c1bb998497f3b6f91ccb9b977b5a062c4553cc5acf2a4cf65de4beec71f
Instruction ID: e521d1b28f8217583aaf9bd3ec9d33ed1dd49639a0384384c5f1f48a6a6e0f12
Opcode Fuzzy Hash: bc451c1bb998497f3b6f91ccb9b977b5a062c4553cc5acf2a4cf65de4beec71f
Instruction Fuzzy Hash: 3B219421B0869257FA309A16B9847BA9A41FF65BD4F8844B0FD0D87787CF3CE045C210

Function 00007FF69E1AC7DC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1AC862

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ec9d5ae5a000e04b57470e1a65c1a2ebd8d322b6e5cd5ccd1e774105d6e8e50b
Instruction ID: b6deebae02b7d1c8b4be6433517ae9ea7c737764fff8824e7971b85a064cb4cc
Opcode Fuzzy Hash: ec9d5ae5a000e04b57470e1a65c1a2ebd8d322b6e5cd5ccd1e774105d6e8e50b
Instruction Fuzzy Hash: AC318D62E5C61285E7716B69988137C2654FFA0BB4F4202B6FA1D933D2CF7CE4898734

Function 00007FF69E1A6EF4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A6E59

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
Instruction ID: ef8b096386033fdba4f52dea2b83e231c44652aef57c9d2bb55f21f2f86c9587
Opcode Fuzzy Hash: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
Instruction Fuzzy Hash: 41117222A4C68181EA70DF51D88027EB2A0FFA5BA4F4440B1FB4CD7B96DF7DD8588760

Function 00007FF69E1B7564 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B7587

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3767eff042e46cd651120d9163f396646e5b690a05a83219cc7a0fcdceb2a680
Instruction ID: 0236e77d4031e390ea11f4227e8dacb13f99dd211d053198b0353619cac4cacc
Opcode Fuzzy Hash: 3767eff042e46cd651120d9163f396646e5b690a05a83219cc7a0fcdceb2a680
Instruction Fuzzy Hash: 09216572A0868287DB718F18E48037976A0EB94B54F184374F65DC77D9DF3CD4448B10

Function 00007FF69E19F8B4 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E19F908

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
Instruction ID: 7ab0798bc8eb72419f0089d66657c4324d5cf7cf38d1a6cd3f98fd27abd3f83c
Opcode Fuzzy Hash: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
Instruction Fuzzy Hash: 8701F921B08B8650EA24DB52A940079A695FFA9FF0F4C42B1FE6C93BDACF3CD4418710

Function 00007FF69E1A8DD8 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A8E16

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9a713ab2503aafe04daa5f14995e032ba301d87e983ca10af8f2e6f3b05e04b1
Instruction ID: 39b0b4055371f0b23749375db30eef20d6eb67031e9154285a52140f0d32ee9b
Opcode Fuzzy Hash: 9a713ab2503aafe04daa5f14995e032ba301d87e983ca10af8f2e6f3b05e04b1
Instruction Fuzzy Hash: CE01B520E8D642D0FE785B65E5C8279A190EF34BB0F844AB6F91DC26D6DF3CE4894230

Function 00007FF69E1A9114 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A912D

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ca4321753697ca9e26add91f4c87d6fa1af88743aafd66e8485bee4c71de2195
Instruction ID: d19495edc04142151c3ae8514a27ac95389bf5c4f687736b73a075f959a7122f
Opcode Fuzzy Hash: ca4321753697ca9e26add91f4c87d6fa1af88743aafd66e8485bee4c71de2195
Instruction Fuzzy Hash: DFE0EC90F8820746FB743AA459CA5792150CF78771F4040F4FA09D62C3DE2CA89D5631

Function 00007FF69E19C37C Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF69E19C390

Part of subcall function 00007FF69E19CDB8: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF69E19CDC0
Part of subcall function 00007FF69E19CDB8: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF69E19CDC5

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 86517d9d3c6548b93fa1a500576de9512fe9d6a130677b1fbe86fe464c74cea3
Instruction ID: 10902c639a5bc3dc35a85864d6ae186545c6a14fd25b0e0fcfba83f9b6c85eac
Opcode Fuzzy Hash: 86517d9d3c6548b93fa1a500576de9512fe9d6a130677b1fbe86fe464c74cea3
Instruction Fuzzy Hash: CEE0E264D0D24382FEB8A66139C62FD1780CF75304F4000FAF88EE21C39E0E329A11B6

Function 00007FF69E1AFDA4 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF69E1AC1CA,?,?,?,00007FF69E1A5DF1,?,?,?,?,00007FF69E1AB332), ref: 00007FF69E1AFDF9

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c31ce9282523e7e70075863a15ee72f4cf677a1c6170370e1c64cff724d2af1b
Instruction ID: fe9f6fa48b7f17efc5ee146f15ac9fdd34c561ac3db770b9f545f21a65807490
Opcode Fuzzy Hash: c31ce9282523e7e70075863a15ee72f4cf677a1c6170370e1c64cff724d2af1b
Instruction Fuzzy Hash: AAF01254B8920385FE755AA299D13B55290EF7D7B0F4C44B1ED0EC67D2EE2CE4898230

Function 00007FF69E1AE664 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF69E1A0208,?,?,?,00007FF69E1A1872,?,?,?,?,?,00007FF69E1A4535), ref: 00007FF69E1AE6A2

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 3c31cf8336a648e9ecfad8ff9b709a6d49b8502715341f1fffc2c41753e32efa
Instruction ID: 15920640b87c0037a3a3ede04b6f74f25f5e1bf4ee8ff7e196daa82f7e4127d0
Opcode Fuzzy Hash: 3c31cf8336a648e9ecfad8ff9b709a6d49b8502715341f1fffc2c41753e32efa
Instruction Fuzzy Hash: 22F0FE50E9D20245FA756AE259C12791290DFA87B0F484AB0FD3EC73C1EE2CE4988531

Non-executed Functions

Function 00007FF69E194C60 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194C70
GetLastError.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194C82
GetProcAddress.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194CB9
GetLastError.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194CCB
GetProcAddress.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194CE4
GetLastError.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194CF6
GetProcAddress.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194D0F
GetLastError.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194D21
GetProcAddress.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194D3D
GetLastError.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194D4F
GetProcAddress.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194D6B
GetLastError.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194D7D
GetProcAddress.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194D99
GetLastError.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194DAB
GetProcAddress.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194DC7
GetLastError.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194DD9
GetProcAddress.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194DF5
GetLastError.KERNEL32(?,00007FF69E19592F,00000000,00007FF69E19272E), ref: 00007FF69E194E07

Strings

PyUnicode_AsUTF8, xrefs: 00007FF69E1952F3, 00007FF69E195315
PyErr_Fetch, xrefs: 00007FF69E194EFF, 00007FF69E194F21
PyImport_AddModule, xrefs: 00007FF69E195013, 00007FF69E195035
PyObject_SetAttrString, xrefs: 00007FF69E1951B1, 00007FF69E1951D3
Py_ExitStatusException, xrefs: 00007FF69E194CDA, 00007FF69E194CFC
PyUnicode_FromString, xrefs: 00007FF69E1953AB, 00007FF69E1953CD
PySys_GetObject, xrefs: 00007FF69E195297, 00007FF69E1952B9
PyRun_SimpleStringFlags, xrefs: 00007FF69E19523B, 00007FF69E19525D
PyObject_Str, xrefs: 00007FF69E1951DF, 00007FF69E195201
PyUnicode_Replace, xrefs: 00007FF69E195407, 00007FF69E195429
PyUnicode_DecodeFSDefault, xrefs: 00007FF69E19534F, 00007FF69E195371
PyStatus_Exception, xrefs: 00007FF69E195269, 00007FF69E19528B
PyConfig_InitIsolatedConfig, xrefs: 00007FF69E194DEB, 00007FF69E194E0D
PyObject_CallFunction, xrefs: 00007FF69E195127, 00007FF69E195149
PyConfig_SetBytesString, xrefs: 00007FF69E194E47, 00007FF69E194E69
PyMem_RawFree, xrefs: 00007FF69E1950CB, 00007FF69E1950ED
PyErr_Restore, xrefs: 00007FF69E194FB7, 00007FF69E194FD9
PyConfig_SetString, xrefs: 00007FF69E194E75, 00007FF69E194E97
PyUnicode_Join, xrefs: 00007FF69E1953D9, 00007FF69E1953FB
Py_Finalize, xrefs: 00007FF69E194D05, 00007FF69E194D27
PyErr_Clear, xrefs: 00007FF69E194ED1, 00007FF69E194EF3
PyErr_Occurred, xrefs: 00007FF69E194F5B, 00007FF69E194F7D
Py_InitializeFromConfig, xrefs: 00007FF69E194D33, 00007FF69E194D55
PyMarshal_ReadObjectFromString, xrefs: 00007FF69E19509D, 00007FF69E1950BF
PyImport_ImportModule, xrefs: 00007FF69E19506F, 00007FF69E195091
PyObject_GetAttrString, xrefs: 00007FF69E195183, 00007FF69E1951A5
Py_DecodeLocale, xrefs: 00007FF69E194CAF, 00007FF69E194CD1
Py_IsInitialized, xrefs: 00007FF69E194D61, 00007FF69E194D83
Py_DecRef, xrefs: 00007FF69E194C66, 00007FF69E194C88
GetProcAddress, xrefs: 00007FF69E194C98
PyConfig_Clear, xrefs: 00007FF69E194DBD, 00007FF69E194DDF
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF69E19520D, 00007FF69E19522F
PyErr_NormalizeException, xrefs: 00007FF69E194F2D, 00007FF69E194F4F
PyErr_Print, xrefs: 00007FF69E194F89, 00007FF69E194FAB
PyEval_EvalCode, xrefs: 00007FF69E194FE5, 00007FF69E195007
PyImport_ExecCodeModule, xrefs: 00007FF69E195041, 00007FF69E195063
PyUnicode_FromFormat, xrefs: 00007FF69E19537D, 00007FF69E19539F
PySys_SetObject, xrefs: 00007FF69E1952C5, 00007FF69E1952E7
Py_PreInitialize, xrefs: 00007FF69E194D8F, 00007FF69E194DB1
PyModule_GetDict, xrefs: 00007FF69E1950F9, 00007FF69E19511B
Failed to get address for %hs, xrefs: 00007FF69E194C91
PyConfig_SetWideStringList, xrefs: 00007FF69E194EA3, 00007FF69E194EC5
PyUnicode_Decode, xrefs: 00007FF69E195321, 00007FF69E195343
PyObject_CallFunctionObjArgs, xrefs: 00007FF69E195155, 00007FF69E195177
PyConfig_Read, xrefs: 00007FF69E194E19, 00007FF69E194E3B

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 6de625b0afea0fd6aae27801294b81f6dcb0a9a8ec30d5caabbdf6c35f3913e6
Instruction ID: d3642ea2e8e426fdec87c7a4fbe80a9d74c528f799cb8a2b259d0cdacf473757
Opcode Fuzzy Hash: 6de625b0afea0fd6aae27801294b81f6dcb0a9a8ec30d5caabbdf6c35f3913e6
Instruction Fuzzy Hash: 4B22A674D0DB0B95FA799B64B8D467823A4EF34785B9814B5F40E82368EF3CB589C231

Function 00007FF69E1B52BC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF69E1B530A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B5976
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B5AEC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B5DAA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B5FCA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B6207
memcpy_s.LIBCPMT ref: 00007FF69E1B62E2
memcpy_s.LIBCPMT ref: 00007FF69E1B638D
memcpy_s.LIBCPMT ref: 00007FF69E1B645C

Strings

1#QNAN, xrefs: 00007FF69E1B5423
1#INF, xrefs: 00007FF69E1B5433
1#IND, xrefs: 00007FF69E1B53F7
1#SNAN, xrefs: 00007FF69E1B541A

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: c4575524e8ee86fd9a87cba2ac56affb94fab6ef5813881534f138d5465f61b4
Instruction ID: bfe1afa5c8f548d2f6277e67e0da7e128d2b18ec3fb60c551460e22a6c8cad30
Opcode Fuzzy Hash: c4575524e8ee86fd9a87cba2ac56affb94fab6ef5813881534f138d5465f61b4
Instruction Fuzzy Hash: 74B2B172E182828BE7758F65D5807FD37A2FB64388F585175EA0D97B88DF38E9008B50

Function 00007FF69E197820 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,00007FF69E197D79,00007FF69E1933DA), ref: 00007FF69E19788B
RemoveDirectoryW.KERNEL32 ref: 00007FF69E19790E
DeleteFileW.KERNEL32 ref: 00007FF69E19792D
FindNextFileW.KERNEL32 ref: 00007FF69E19793B
FindClose.KERNEL32 ref: 00007FF69E19794C
RemoveDirectoryW.KERNEL32 ref: 00007FF69E197955

Strings

%s\*, xrefs: 00007FF69E197852

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: a59324ccc20e9abc9d1c8baff1f563e98a4915fa2aaf86765e83aa4fac58e8fb
Instruction ID: 35f91e830464491859b42c58a147148c85f717f18738a0651b53f28f65b0226b
Opcode Fuzzy Hash: a59324ccc20e9abc9d1c8baff1f563e98a4915fa2aaf86765e83aa4fac58e8fb
Instruction Fuzzy Hash: 7B413121E1C94692EA309B24F4C42BD63A1FFA4764F940672F99EC3698DF3CD54AC750

Function 00007FF69E19A20D Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid distance too far back, xrefs: 00007FF69E19ABD0
invalid literal/length code, xrefs: 00007FF69E19A942
invalid bit length repeat, xrefs: 00007FF69E19A5F9
invalid distances set, xrefs: 00007FF69E19A700
invalid code -- missing end-of-block, xrefs: 00007FF69E19A626
too many length or distance symbols, xrefs: 00007FF69E19A3A6
invalid distance code, xrefs: 00007FF69E19AB14
invalid literal/lengths set, xrefs: 00007FF69E19A693
invalid code lengths set, xrefs: 00007FF69E19A38D

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: ad07e8188c613946626f78378622a9a621fd1c9396756703324ddb84a9a7dc26
Instruction ID: 2df0d710d6232a3e1e3b57d2d2685e7d7d80d6d4bf311e5eb2f8d0538b8b2cd1
Opcode Fuzzy Hash: ad07e8188c613946626f78378622a9a621fd1c9396756703324ddb84a9a7dc26
Instruction Fuzzy Hash: 1152E576A146A68BE7648F14E498B7E3BA9FB54340F054139F64AC7780DF3DE944CB10

Function 00007FF69E19C69C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF69E19C6B8
RtlCaptureContext.KERNEL32 ref: 00007FF69E19C6E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF69E19C6FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF69E19C740
IsDebuggerPresent.KERNEL32 ref: 00007FF69E19C794
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF69E19C7B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF69E19C7BC

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 4c3f9a964b5662b5dbbc0689ef1495c1f66ffbf8daaed71a8dc58c0a28c42fd7
Instruction ID: 48d8fc9ba8795f670667c0c656e05ca22a1300938ae2322315dd79c9dadac135
Opcode Fuzzy Hash: 4c3f9a964b5662b5dbbc0689ef1495c1f66ffbf8daaed71a8dc58c0a28c42fd7
Instruction Fuzzy Hash: 6B314172A08B8186EB749F60E8807EE7364FB94744F44407AEA4D87B98DF38D648C720

Function 00007FF69E1AB4F8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF69E1AB571
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF69E1AB589
RtlVirtualUnwind.KERNEL32 ref: 00007FF69E1AB5C4
IsDebuggerPresent.KERNEL32 ref: 00007FF69E1AB5FD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF69E1AB607
UnhandledExceptionFilter.KERNEL32 ref: 00007FF69E1AB612

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: c2ba82a54335b4e9d04d7430b1e7b135fe56bba1662feab656e26de9ce49381a
Instruction ID: 02b87f0e702df08b2c726129fb5cd14f62dbd9b47dc2ac2e430f8e6b3417860f
Opcode Fuzzy Hash: c2ba82a54335b4e9d04d7430b1e7b135fe56bba1662feab656e26de9ce49381a
Instruction Fuzzy Hash: E6315E32A08F8186EB748F25E8807AE73A4FB98754F540176EA9D83B59DF38C545CB10

Function 00007FF69E1B2A84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B2AD0
FindFirstFileExW.KERNEL32 ref: 00007FF69E1B2BDA

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: f48cdeeaa627aae7c3eec5e50addf66f248ab40f3829e93bfdfbfe5e0fd658b4
Instruction ID: 956beb202ab77a13739cdc004e267d500a4d63bb8865a9ec81726f8d36cf56dc
Opcode Fuzzy Hash: f48cdeeaa627aae7c3eec5e50addf66f248ab40f3829e93bfdfbfe5e0fd658b4
Instruction Fuzzy Hash: CBB1B722F1869241EB719B21E5806B963A1FB68BE4F484171FE5E87BDDDE3CE449C310

Function 00007FF69E19C580 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF69E19C5AC
GetCurrentThreadId.KERNEL32 ref: 00007FF69E19C5BA
GetCurrentProcessId.KERNEL32 ref: 00007FF69E19C5C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF69E19C5D6

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d3533d9dc536a73865986143b90d72cf7f467817cff5a9e1fc853e7b0dbb7422
Instruction ID: fb7dcd82c348df1762a924d6e86c066ad9c6bc81028ad29900b25556172e59f7
Opcode Fuzzy Hash: d3533d9dc536a73865986143b90d72cf7f467817cff5a9e1fc853e7b0dbb7422
Instruction Fuzzy Hash: 93115A26B14F058AEB10DF60E8942B833A4FB28758F040E31EA6D827A8DF3CD1948350

Function 00007FF69E1B4E20 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF69E1B4E86
memcpy_s.LIBCPMT ref: 00007FF69E1B4EB1

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 8b9598c42af2be669f837b758dad462e972c2f3554ae0d254eaf521387dca06f
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 0DC1D672F1968687E734CF59A08466AB792FBA4784F488175EB4E87748DF3DE801CB40

Function 00007FF69E1999D4 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00007FF69E199E81
unknown header flags set, xrefs: 00007FF69E199A25
, xrefs: 00007FF69E199ABB

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 6e2020b5cb39277fe5e5e4e5c4a13ab7fb1d5b65fd85fadca5bee3537132e9f6
Instruction ID: 845ce4bf32c0b3fbee4ac7524b7bb62ce6b013942fa0ff5df7e9f02228213a67
Opcode Fuzzy Hash: 6e2020b5cb39277fe5e5e4e5c4a13ab7fb1d5b65fd85fadca5bee3537132e9f6
Instruction Fuzzy Hash: CBF19F72A183D58BE7B58B15E4C8A3E3AE9FF64744F0645B9EA4987390CF38E940C750

Function 00007FF69E1BA938 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF69E1BAB87
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF69E192BC5), ref: 00007FF69E1BAB98

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: cc6ff36f15a987c5b1bf507e00e0aa7011c6f5d0d309d4bd8392734804a295b4
Instruction ID: 5e4436b9dec1f57399b737655dfab4b1619403b50869bb334f8268a4fe053bd6
Opcode Fuzzy Hash: cc6ff36f15a987c5b1bf507e00e0aa7011c6f5d0d309d4bd8392734804a295b4
Instruction Fuzzy Hash: 48B15E73A04B898BE725CF29C58636C7BA0F754B88F198961EB5D837A8CF39D451C710

Function 00007FF69E1A43F0 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF69E1A455E
, xrefs: 00007FF69E1A47A0

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 0021d0b55369085dcf1ff5482033bdc548e1137304a7c6608840e23669f70ad1
Instruction ID: eeb3061ef5102ec6083c7cac81c875e601fb4893208a9fb73bf95a11c3fb2575
Opcode Fuzzy Hash: 0021d0b55369085dcf1ff5482033bdc548e1137304a7c6608840e23669f70ad1
Instruction Fuzzy Hash: ECE13772A4864282EB788F2990D013D33A0FF65B68F144275EA5E83794CF3DE849C768

Function 00007FF69E19983B Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF69E1999A2
incorrect header check, xrefs: 00007FF69E1999BB

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 54a98338222019f7aed6b75a4533e603b1a02d8b4749202910f179bc825ff2c3
Instruction ID: 4ffde71a9676dc730c0bff78f351f8516a3352d53b97dc854e9ea58b72e59cff
Opcode Fuzzy Hash: 54a98338222019f7aed6b75a4533e603b1a02d8b4749202910f179bc825ff2c3
Instruction Fuzzy Hash: 04919676A182868BE7B48B14E4C8B7E3AA9FB54354F154179EA4AC77C0CF3CE944CB10

Function 00007FF69E1AEF58 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF69E1AF0E2
e+000, xrefs: 00007FF69E1AF065

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 8b6ee54fbb186269fe71b90b1026ad24f386125e73444afbdf5cadaf5bd6b187
Instruction ID: 1e950ae80326c0ce83336d026d28ccff9488ddb007c2ee14d3ead53b55c85313
Opcode Fuzzy Hash: 8b6ee54fbb186269fe71b90b1026ad24f386125e73444afbdf5cadaf5bd6b187
Instruction Fuzzy Hash: 3D515B62B182C546E7348A35E98077D6791F768BA4F488271EBA8C7EC5CE3DD4498710

Function 00007FF69E1AEAC4 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF69E1AEE06

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 1e22957b1159dd03df7ccd337d5a67203babfefd7ac1e182ea12ea91d3eef3d6
Instruction ID: 661721e568ffc2728cc1c1093355951891b84b66438b1725ab51dea8bebc5249
Opcode Fuzzy Hash: 1e22957b1159dd03df7ccd337d5a67203babfefd7ac1e182ea12ea91d3eef3d6
Instruction Fuzzy Hash: EBA16A62B087C686EB31CF2590807B97B91EB60BE4F448072EE4D87785DE3DE44AC711

Function 00007FF69E1A9670 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF69E1A968F

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 99790e8c3e6fb60506200e2aa0b8d900239d419619a9b9dba0657c5dbd7d84e4
Instruction ID: 7c04cd8213ebf835f9e8c67a3cc822a89bc83568293f85fceeff0ac5fb00bdf4
Opcode Fuzzy Hash: 99790e8c3e6fb60506200e2aa0b8d900239d419619a9b9dba0657c5dbd7d84e4
Instruction Fuzzy Hash: 8351A311F8834241FE74AB66758157A6291EFA4BE4F4844B4FE0DC7796DE3CE48A8220

Function 00007FF69E1B4690 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF69E1B4694

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8d8bf03bc1d3c2add78311a657f4b90d934f15b0b18570f2c87e070252fc9345
Instruction ID: 2cf860dd5ea5cc6ef4267e0cf2b9fc783ab16e04a0139d8c8fde93afb3bfec9a
Opcode Fuzzy Hash: 8d8bf03bc1d3c2add78311a657f4b90d934f15b0b18570f2c87e070252fc9345
Instruction Fuzzy Hash: 47B09224E17A02C6EA582B916CC231822A4BF68710F9844B9E00C81320DE2C20EA5720

Function 00007FF69E1A3F2C Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452a8a0d8feebdf1122eaccf447c44c0daa3d090f9a155463ed8f505442a48ba
Instruction ID: 2e773ceddcebc050232eed696c5dc546970f27ead5007a71d576ad9a30afd35f
Opcode Fuzzy Hash: 452a8a0d8feebdf1122eaccf447c44c0daa3d090f9a155463ed8f505442a48ba
Instruction Fuzzy Hash: 91E1E426A4824282EB789E25C1C027D27A1FFA0B64F144175EE4E877D9CF3DE84DD369

Function 00007FF69E1A36F0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d7b7b3454c8bcad5c9b4cf135b982f8fa5d1e780f0237f0391cdb5e6506841
Instruction ID: 4ce22bda59483f1a482eb3f32a4ad59e62b7b2cca55ad04f15a56be1538e0d38
Opcode Fuzzy Hash: c1d7b7b3454c8bcad5c9b4cf135b982f8fa5d1e780f0237f0391cdb5e6506841
Instruction Fuzzy Hash: 60E1D672A4864285E7788E28C1D437C2791EB65B74F148275EE4EC76D6CF3DE889C360

Function 00007FF69E1A3B28 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd5c4a82e290d99fc75fabc4b345746dc03237e35c2450d1ffc439358ea8dbf
Instruction ID: a27a537081519b00b2a790f255f0f80769a4a93fe4fcc1d977b44a4e60be24d3
Opcode Fuzzy Hash: 5cd5c4a82e290d99fc75fabc4b345746dc03237e35c2450d1ffc439358ea8dbf
Instruction Fuzzy Hash: 62D1E832A4864285EB798E29C48037D27A0FF65B68F544276EE0DC76D6DF3DE849C360

Function 00007FF69E198D60 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6192ed08a1a978d00d287ecd5f622c1b7fed234d7f6e4ec670f252232e35394f
Instruction ID: 0d8194af921354ec66e4d3336148f172983516543e80ee77bdd7c253fbe6b469
Opcode Fuzzy Hash: 6192ed08a1a978d00d287ecd5f622c1b7fed234d7f6e4ec670f252232e35394f
Instruction Fuzzy Hash: 67C19AB22141E14BD299DB29E46957B73E1F798389BC4807BEF8B47B85CA3CE014D711

Function 00007FF69E1A23C0 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f16fb8a4f792395a96249c32a5e1723cb20c7f6a9977c10f3922fef282cb15bd
Instruction ID: 98eeb5c3079dda25cda4230cd5edf9a3cb4742a3a729351dd1259ee08091471b
Opcode Fuzzy Hash: f16fb8a4f792395a96249c32a5e1723cb20c7f6a9977c10f3922fef282cb15bd
Instruction Fuzzy Hash: 5AB1BE72A4964185E7749F39C1A027D3BA0FB2DB68F1841B5EE4D87399DF39D848C720

Function 00007FF69E1A2758 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ea6f0edc2c58364f58995ddce025b390f3c278012a74096240329ea132a1c8
Instruction ID: e88989d0493c21b5ced674bd496c01aeb8528e977491297829bd9db6d6c8f95b
Opcode Fuzzy Hash: 67ea6f0edc2c58364f58995ddce025b390f3c278012a74096240329ea132a1c8
Instruction Fuzzy Hash: 3BB18F7294879589E7758F39C19023C3BA0E769F68F2401B5EB4E87799CF39D889C720

Function 00007FF69E1AF5D8 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847d6bf65b96cba8c7d30e9d62c328f88bdcc6dffd0926808ea1049b5e5cea66
Instruction ID: 4dc61289d53282d0c5ce6da26df9f056919cc45e7c955ddd348542c54ce9807b
Opcode Fuzzy Hash: 847d6bf65b96cba8c7d30e9d62c328f88bdcc6dffd0926808ea1049b5e5cea66
Instruction Fuzzy Hash: DA81F472A4878146E7B4CF29A4C037A7A90FB697E4F144275EA9D83F99CF3CD4488B10

Function 00007FF69E1B7628 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b59436847b04fb0d62a580c32b85b0eb8f16ff054c2966653e54822e0f4ea234
Instruction ID: 206976907fad4bde8455635440bc4fd6c0cde1723270a5abe5fadbe64390c5b1
Opcode Fuzzy Hash: b59436847b04fb0d62a580c32b85b0eb8f16ff054c2966653e54822e0f4ea234
Instruction Fuzzy Hash: 5961D222E0C29247F7758A2894D437D6681EF60370F5843B9FA2EC6BD9DE7DE8408720

Function 00007FF69E1A16DC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 17dc75e5a4f0bbdb5915b46f1a552c118ca0bc308d0f2d84e0caadf42aaaa618
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: CC51C8B6B5865186E7388B29C08023833A1EB64F78F285171EE4D97794DF3AE887C750

Function 00007FF69E1A0EBC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 86b4236ed6a393fcf8c0bd2f030109637c97f4360e5a387a96d3cdccba034dc2
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 07519472B58A51C6E7348B29C09027D37A0EB65B78F244171EE4D977A4CF3AE84BC750

Function 00007FF69E1A12CC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 8ac30891c3aabdcebb228cd9f2a8850f7d3fd396d4451da5ba0ba79f4a6706ce
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: FB5190B6B5865182E7388F29C08027833A0EB64B78F284175EA4D87B95CF3AE847C750

Function 00007FF69E1A10C8 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9c7dfd85d7e05c9dc9b7e40d932aad9843605f203f1a6a08d3cc10701c718b
Instruction ID: 73f81e90901f900a22a1fe3a71833c65caee87b46816fd553d1f0f026e189759
Opcode Fuzzy Hash: 7c9c7dfd85d7e05c9dc9b7e40d932aad9843605f203f1a6a08d3cc10701c718b
Instruction Fuzzy Hash: AF51B3B6B5865186E7388B29C08027837B1EB64F68F284171EE4C87795CF3AEC47C790

Function 00007FF69E1A14D8 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7710b6301a9c53c0f35ccf6fc131232db227f89fb6367f1206a3fe51f4b04988
Instruction ID: 28669a959dfdffa5579454b20291d245f827a4a94f542271d2a1be73e9dbc83f
Opcode Fuzzy Hash: 7710b6301a9c53c0f35ccf6fc131232db227f89fb6367f1206a3fe51f4b04988
Instruction Fuzzy Hash: A651B3B6B5865186E7388B29C08427837B0EB65F78F284171EE4DC7795CF3AE846C750

Function 00007FF69E1A0CB8 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b300af1d1946d5df55db44b3d4e0876ae34829a82d49cb6751e26c04e9c1898
Instruction ID: 0a1ef28aa302dd27a5ce6d9fe356656e922c5266a3912cd13d1db009d7097b42
Opcode Fuzzy Hash: 3b300af1d1946d5df55db44b3d4e0876ae34829a82d49cb6751e26c04e9c1898
Instruction Fuzzy Hash: CE519037A58651C6E7348B29C08023937A0EB65B68F244171EE4D977A4CF3AF84BC750

Function 00007FF69E1A6C90 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 7d33216871b1c88e7dbad5fe8c7a47ea47245fb44727557a96b461823f761ee1
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 4B419F5288978E45E9B5C968C5846B83A80DF32BF0F5852F0EDE9D73D7CD1D259E8220

Function 00007FF69E1AADC0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8ebaae5e878847fb0972dee39ef615be72aee41a86628d284291b13d6747971f
Instruction ID: 07c30b0de13817b69e0b783730c5cab22065d8588c155c94df1589400cff9293
Opcode Fuzzy Hash: 8ebaae5e878847fb0972dee39ef615be72aee41a86628d284291b13d6747971f
Instruction Fuzzy Hash: 7C41D362714A5582EF18CF2AD99417DA3A2FB58FD0F099036EE0DD7B68DE3CD0468300

Function 00007FF69E1A8FC0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4b82ba6feb1f2c625fcdd7b78fc6310e7e433b3778e25011fb45a65c2c329c
Instruction ID: 78f0ec45a89b30169bfe873da0c9cd20825b8d1c43bf961cf4e77018fb90a968
Opcode Fuzzy Hash: 3b4b82ba6feb1f2c625fcdd7b78fc6310e7e433b3778e25011fb45a65c2c329c
Instruction Fuzzy Hash: FA31B432B08B8242EB749F25758013D7698EF94BE0F184278FA9E93B96DF3CD0468314

Function 00007FF69E1BA780 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e5edaf8da66d94c9ca9aff6d9c04a456296df9a737362746998e6ef114c740
Instruction ID: 0f419fedd4a8058c6486c42aaf8f6416702dba7509df4846452b6229a4211140
Opcode Fuzzy Hash: 00e5edaf8da66d94c9ca9aff6d9c04a456296df9a737362746998e6ef114c740
Instruction Fuzzy Hash: 10F06871B282959ADBA4CF2DA44362977E0F7183C0F90807AE68DC3B04DB7CD0508F14

Function 00007FF69E19C840 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92d020b70be0a3987cc02b3edb33e09e79c2d1aa04247a81d94d631aa8b8d9b
Instruction ID: 3d451c750005e850dd04cb4d8655cf118f0bb26f834e89fd84e6e782a342b583
Opcode Fuzzy Hash: c92d020b70be0a3987cc02b3edb33e09e79c2d1aa04247a81d94d631aa8b8d9b
Instruction Fuzzy Hash: 4FA00121918882D0F6689B00A9A41206361FB75300B8600F5E05D811A89F6CA4408260

Function 00007FF69E196B20 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF69E196B37
GetLastError.KERNEL32 ref: 00007FF69E196B49
GetProcAddress.KERNEL32 ref: 00007FF69E196B85
GetLastError.KERNEL32 ref: 00007FF69E196B97
GetProcAddress.KERNEL32 ref: 00007FF69E196BB0
GetLastError.KERNEL32 ref: 00007FF69E196BC2
GetProcAddress.KERNEL32 ref: 00007FF69E196BDB
GetLastError.KERNEL32 ref: 00007FF69E196BED
GetProcAddress.KERNEL32 ref: 00007FF69E196C09
GetLastError.KERNEL32 ref: 00007FF69E196C1B
GetProcAddress.KERNEL32 ref: 00007FF69E196C37
GetLastError.KERNEL32 ref: 00007FF69E196C49
GetProcAddress.KERNEL32 ref: 00007FF69E196C65
GetLastError.KERNEL32 ref: 00007FF69E196C77
GetProcAddress.KERNEL32 ref: 00007FF69E196C93
GetLastError.KERNEL32 ref: 00007FF69E196CA5
GetProcAddress.KERNEL32 ref: 00007FF69E196CC1
GetLastError.KERNEL32 ref: 00007FF69E196CD3

Strings

Tcl_ThreadQueueEvent, xrefs: 00007FF69E196E27, 00007FF69E196E49
Tcl_NewStringObj, xrefs: 00007FF69E196F3B, 00007FF69E196F5D
Tcl_ThreadAlert, xrefs: 00007FF69E196E55, 00007FF69E196E77
Tk_GetNumMainWindows, xrefs: 00007FF69E197107, 00007FF69E197129
Tcl_CreateThread, xrefs: 00007FF69E196C89, 00007FF69E196CAB
Tcl_ConditionFinalize, xrefs: 00007FF69E196D9D, 00007FF69E196DBF
Tcl_GetString, xrefs: 00007FF69E196F0D, 00007FF69E196F2F
Tcl_Init, xrefs: 00007FF69E196B30, 00007FF69E196B4F
Tcl_DoOneEvent, xrefs: 00007FF69E196BD1, 00007FF69E196BF3
Tcl_NewByteArrayObj, xrefs: 00007FF69E196F69, 00007FF69E196F8B
Tcl_Finalize, xrefs: 00007FF69E196BFF, 00007FF69E196C21
Tcl_FindExecutable, xrefs: 00007FF69E196BA6, 00007FF69E196BC8
Tcl_JoinThread, xrefs: 00007FF69E196CE5, 00007FF69E196D07
Tcl_FinalizeThread, xrefs: 00007FF69E196C2D, 00007FF69E196C4F
Tcl_MutexLock, xrefs: 00007FF69E196D13, 00007FF69E196D35
Tcl_CreateInterp, xrefs: 00007FF69E196B7B, 00007FF69E196B9D
Tcl_MutexFinalize, xrefs: 00007FF69E196D6F, 00007FF69E196D91
Tcl_ConditionNotify, xrefs: 00007FF69E196DCB, 00007FF69E196DED
Tcl_Free, xrefs: 00007FF69E1970AB, 00007FF69E1970CD
GetProcAddress, xrefs: 00007FF69E196B5F
Tcl_EvalFile, xrefs: 00007FF69E196FF3, 00007FF69E197015
Tcl_EvalObjv, xrefs: 00007FF69E19704F, 00007FF69E197071
Tcl_SetVar2, xrefs: 00007FF69E196EB1, 00007FF69E196ED3
Tcl_SetVar2Ex, xrefs: 00007FF69E196F97, 00007FF69E196FB9
Tcl_GetCurrentThread, xrefs: 00007FF69E196CB7, 00007FF69E196CD9
Tcl_GetVar2, xrefs: 00007FF69E196E83, 00007FF69E196EA5
Tcl_DeleteInterp, xrefs: 00007FF69E196C5B, 00007FF69E196C7D
Failed to get address for %hs, xrefs: 00007FF69E196B58
Tcl_MutexUnlock, xrefs: 00007FF69E196D41, 00007FF69E196D63
Tcl_CreateObjCommand, xrefs: 00007FF69E196EDF, 00007FF69E196F01
Tcl_EvalEx, xrefs: 00007FF69E197021, 00007FF69E197043
Tk_Init, xrefs: 00007FF69E1970D9, 00007FF69E1970FB
Tcl_Alloc, xrefs: 00007FF69E19707D, 00007FF69E19709F
Tcl_ConditionWait, xrefs: 00007FF69E196DF9, 00007FF69E196E1B
Tcl_GetObjResult, xrefs: 00007FF69E196FC5, 00007FF69E196FE7

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 3545b632f7dd823c1b1133c9911c0dd850097e31ef49371059c2c54a7d8a6d57
Instruction ID: a931f7f5b940a0105a9df27c3afbf2d041e0b9a486986414c3289a400095341b
Opcode Fuzzy Hash: 3545b632f7dd823c1b1133c9911c0dd850097e31ef49371059c2c54a7d8a6d57
Instruction Fuzzy Hash: 1B029664E0DB0791FA799B64B9D46B82361FF38784B8805F5F40E86368EF3CA549C231

Function 00007FF69E197630 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E1988F0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF69E193A24,00000000,00007FF69E191965), ref: 00007FF69E198929

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF69E197B17,FFFFFFFF,00000000,?,00007FF69E193101), ref: 00007FF69E19768C

Strings

%.*s, xrefs: 00007FF69E19776C
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF69E197663
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF69E1976A0
CreateDirectory, xrefs: 00007FF69E1977DC
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF69E1977D3
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF69E1976FD
\, xrefs: 00007FF69E1976C1
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF69E197739

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 2001182103-930877121
Opcode ID: 707c7b7851dfd3ef8d883f7eed24ffe0d7b91c1d10e5f50f89d3ac19d4dd3b00
Instruction ID: cf22801d48563de100967e01b3eb1e6f6f89d88a652893506da683d61c7fe9ef
Opcode Fuzzy Hash: 707c7b7851dfd3ef8d883f7eed24ffe0d7b91c1d10e5f50f89d3ac19d4dd3b00
Instruction Fuzzy Hash: 31519621F2C64252FA78DB25F9D56FA2251FFB4780F4404B2F90EC2699EE2CE1458760

Function 00007FF69E197520 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF69E19755F
GetWindowLongPtrW.USER32 ref: 00007FF69E1975DF
ShutdownBlockReasonCreate.USER32 ref: 00007FF69E1975F2
GetLastError.KERNEL32 ref: 00007FF69E1975FC
SetWindowLongPtrW.USER32 ref: 00007FF69E197613

Strings

Needs to remove its temporary files., xrefs: 00007FF69E1975E5

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: c723b84fa84041d2a065d0033a4badd5460eb4b6c3bbebd043b9f2ff103e8564
Instruction ID: 1275f1ee9173335020e219f0add379101b3ec25d9543c33318dd4f36eca7c9cc
Opcode Fuzzy Hash: c723b84fa84041d2a065d0033a4badd5460eb4b6c3bbebd043b9f2ff103e8564
Instruction Fuzzy Hash: D2219A61F08A4282F7695B7AB8C42796350EFA8B90F4D4170FE1DC33A9DE3CD5858321

Function 00007FF69E1A71F0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A7233
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A7620
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A78BC

Strings

-, xrefs: 00007FF69E1A72C9
p, xrefs: 00007FF69E1A72E5
p, xrefs: 00007FF69E1A735D
:, xrefs: 00007FF69E1A73EC
f, xrefs: 00007FF69E1A7355

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: e9dff4c7d7db8c9caf29eda043108d28daa86f10b799ebf646d9334941ecdb5d
Instruction ID: a7bcb9e5e34939559073b49627eacafd38194e2a0039958920cbdc9efee7482e
Opcode Fuzzy Hash: e9dff4c7d7db8c9caf29eda043108d28daa86f10b799ebf646d9334941ecdb5d
Instruction Fuzzy Hash: D712A462E4C24387FB346B14E09467A7691FB60770F844576F69A876C4DF3CEA88CB24

Function 00007FF69E1A0540 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A0580
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A0948
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A0BE7

Strings

p, xrefs: 00007FF69E1A0625
f, xrefs: 00007FF69E1A07CD
f, xrefs: 00007FF69E1A0618
p, xrefs: 00007FF69E1A068A
f, xrefs: 00007FF69E1A0682

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: a928b4930c166735193e7b4620c82218776b27d3a8fd15f56e8eec83f28e26cd
Instruction ID: 25fa106d0e7e921b5dc0be05a6d37b3d33d0cb9daada96fff9755bff595275a4
Opcode Fuzzy Hash: a928b4930c166735193e7b4620c82218776b27d3a8fd15f56e8eec83f28e26cd
Instruction Fuzzy Hash: 0E12B266E4C143C6FB309E14E0946BA7261FB60764FC84171F6CE866E4DF7CE9889B24

Function 00007FF69E191030 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF69E1910E8
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF69E1910AC
fseek, xrefs: 00007FF69E1910B3
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF69E1911D6
fread, xrefs: 00007FF69E1911DD
malloc, xrefs: 00007FF69E1910EF
Failed to extract %s: failed to open archive file!, xrefs: 00007FF69E191078

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 98735fc833f45bc53380bc4a74af040184e2df3462c9a9388a2020815b671cfc
Instruction ID: 476a10df5db992b6842fc18cb280d4d3e91e5d49ce88013f8fd387f86b4be5a0
Opcode Fuzzy Hash: 98735fc833f45bc53380bc4a74af040184e2df3462c9a9388a2020815b671cfc
Instruction Fuzzy Hash: 6B41B262F0865252FA28DB21B8846B96391FF64BD0F4544B2FD0D87796DE3CE8858760

Function 00007FF69E191450 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF69E1914F8
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF69E1914BE
fseek, xrefs: 00007FF69E1914C5
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF69E1915BF
fread, xrefs: 00007FF69E1915C6
malloc, xrefs: 00007FF69E1914FF
Failed to extract %s: failed to open archive file!, xrefs: 00007FF69E19147F

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 1b1c50dd745969e06b7310acb5dde250f69d1e0c43c64646fe4b3d807e4437c5
Instruction ID: c159f3db215362ed4f95ac2cfb4c0df4f3e8716bc48664a9ee9cbc609f804acc
Opcode Fuzzy Hash: 1b1c50dd745969e06b7310acb5dde250f69d1e0c43c64646fe4b3d807e4437c5
Instruction Fuzzy Hash: 16418F72B0864256FB28DB21E4802F96391FF69794F8544B2FD0D87B99DE3CE585C720

Function 00007FF69E19DF38 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF69E19DF95

Part of subcall function 00007FF69E19EEEC: __GetUnwindTryBlock.LIBCMT ref: 00007FF69E19EF2F
Part of subcall function 00007FF69E19EEEC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF69E19EF54

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF69E19E06D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF69E19E2BB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69E19E3C8

Strings

csm, xrefs: 00007FF69E19E016
csm, xrefs: 00007FF69E19E090
csm, xrefs: 00007FF69E19DFAF

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 6e9e033ed6031b1d797039d272c1e65d04a1f40577f6f2a6ca58cdf15e4e0b3b
Instruction ID: 8646d89828ebb0f9cf28b7eadce8c829bc550302ea0fd569d83cbc11cf2c4c92
Opcode Fuzzy Hash: 6e9e033ed6031b1d797039d272c1e65d04a1f40577f6f2a6ca58cdf15e4e0b3b
Instruction Fuzzy Hash: EFD18E32A08B4186EB309F65E4803AD77A0FB65798F240176FE8D97B96CF38E191C711

Function 00007FF69E1AFF1C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF69E1B02B6,?,?,0000016256B75BC8,00007FF69E1ABBFB,?,?,?,00007FF69E1ABAF2,?,?,?,00007FF69E1A6E9E), ref: 00007FF69E1B0098
GetProcAddress.KERNEL32(?,?,?,00007FF69E1B02B6,?,?,0000016256B75BC8,00007FF69E1ABBFB,?,?,?,00007FF69E1ABAF2,?,?,?,00007FF69E1A6E9E), ref: 00007FF69E1B00A4

Strings

ext-ms-, xrefs: 00007FF69E1AFFF5
api-ms-, xrefs: 00007FF69E1AFFE2

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: aadbaee7c76e5d54b6d4897acaf79a0667e5faa90471c45c14db321705774b03
Instruction ID: 140bb78ae58457421dcfa4ec9f65e93233f59a8d28d739dcad3cf6f77e6d66b8
Opcode Fuzzy Hash: aadbaee7c76e5d54b6d4897acaf79a0667e5faa90471c45c14db321705774b03
Instruction Fuzzy Hash: 2C41A022F19A42C1EA368B16A8806792392FF69BE0F494175ED0DC77A8DE7DE4458224

Function 00007FF69E192310 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 99windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF69E192AC6,?,00007FF69E192BC5), ref: 00007FF69E192360
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF69E192AC6,?,00007FF69E192BC5), ref: 00007FF69E19241A

Strings

<FormatMessageW failed.>, xrefs: 00007FF69E192427
[PYI-%d:ERROR] , xrefs: 00007FF69E192368
%ls: , xrefs: 00007FF69E1923D9
%ls, xrefs: 00007FF69E192448

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentFormatMessageProcess
String ID: %ls$%ls: $<FormatMessageW failed.>$[PYI-%d:ERROR]
API String ID: 27993502-4247535189
Opcode ID: f44dac26104a74f6fbc2184d3fd8cb70647f8f70ec85c50d3a7ef1bf325d76e2
Instruction ID: f4d9cb6436fde89dac3508983dc261047a9ed4db845ae544fc39b309e31f5b5a
Opcode Fuzzy Hash: f44dac26104a74f6fbc2184d3fd8cb70647f8f70ec85c50d3a7ef1bf325d76e2
Instruction Fuzzy Hash: 1F31B122B0864141F6349725B8946EA62A1FF98B94F410176FE8DD3B59DE3CE546C710

Function 00007FF69E19D1F8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF69E19D4AA,?,?,?,00007FF69E19D19C,?,?,?,00007FF69E19CD99), ref: 00007FF69E19D27D
GetLastError.KERNEL32(?,?,?,00007FF69E19D4AA,?,?,?,00007FF69E19D19C,?,?,?,00007FF69E19CD99), ref: 00007FF69E19D28B
LoadLibraryExW.KERNEL32(?,?,?,00007FF69E19D4AA,?,?,?,00007FF69E19D19C,?,?,?,00007FF69E19CD99), ref: 00007FF69E19D2B5
FreeLibrary.KERNEL32(?,?,?,00007FF69E19D4AA,?,?,?,00007FF69E19D19C,?,?,?,00007FF69E19CD99), ref: 00007FF69E19D323
GetProcAddress.KERNEL32(?,?,?,00007FF69E19D4AA,?,?,?,00007FF69E19D19C,?,?,?,00007FF69E19CD99), ref: 00007FF69E19D32F

Strings

api-ms-, xrefs: 00007FF69E19D29D

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: cfe7c3e8e36681254bad5299873ee692e307dc20b52bfdb0e9be079fe62a9b1d
Instruction ID: fbae88182043e1ae3b7a3376621f15604f9b395ecb6d30a45107b2ddf5002a9e
Opcode Fuzzy Hash: cfe7c3e8e36681254bad5299873ee692e307dc20b52bfdb0e9be079fe62a9b1d
Instruction Fuzzy Hash: F531B221B1AA4291EE359B42B8807792394FF69BA0F5A0575ED1DC7394DF3CE445C334

Function 00007FF69E1957C0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Failed to load Python DLL '%ls'., xrefs: 00007FF69E195907
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF69E195867
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF69E195827
ucrtbase.dll, xrefs: 00007FF69E19583D
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF69E1958B6
LoadLibrary, xrefs: 00007FF69E19590E

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 8f2beb87be42e2e941db9166639801d5cbaf6a7c9720615fb91e21965ec7150f
Instruction ID: 45fde336b960ba385dc2fc29373c465883111783f3788f37084f2ff92a899d81
Opcode Fuzzy Hash: 8f2beb87be42e2e941db9166639801d5cbaf6a7c9720615fb91e21965ec7150f
Instruction Fuzzy Hash: E1419E31E08A8B91FA35DB21F4842E96315FB64384F800172FA5ED769AEF3CE645C360

Function 00007FF69E1ABFF0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF69E1ABFFF
FlsGetValue.KERNEL32 ref: 00007FF69E1AC014
FlsSetValue.KERNEL32 ref: 00007FF69E1AC035
FlsSetValue.KERNEL32 ref: 00007FF69E1AC062
FlsSetValue.KERNEL32 ref: 00007FF69E1AC073
FlsSetValue.KERNEL32 ref: 00007FF69E1AC084
SetLastError.KERNEL32 ref: 00007FF69E1AC09F

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 0b20348f9c1a83954d0a053c40579325a412568fb84c9ff09bb00993ff3f795b
Instruction ID: c05d9afc6759ee4840c0c4ac5a0f4b3694d122384e56cec4523ea8114e4de39a
Opcode Fuzzy Hash: 0b20348f9c1a83954d0a053c40579325a412568fb84c9ff09bb00993ff3f795b
Instruction Fuzzy Hash: 4F215024E8C64282F979673597C117D5256CF647B0F1447B5F83ECABEADE2CE8494320

Function 00007FF69E1B8F7C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF69E1B8FAD
GetLastError.KERNEL32 ref: 00007FF69E1B8FB9
CloseHandle.KERNEL32 ref: 00007FF69E1B8FD1
CreateFileW.KERNEL32 ref: 00007FF69E1B8FFC
WriteConsoleW.KERNEL32 ref: 00007FF69E1B901B

Strings

CONOUT$, xrefs: 00007FF69E1B8FDD

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 09dec002ca810f05fd5d7c823bfe6aa00a703a0ca75bfd1bbea9b479bbcb78f6
Instruction ID: b832dec5249f35651b9c7bbeee19736c715cd2453ea80b947d604823c30c17ad
Opcode Fuzzy Hash: 09dec002ca810f05fd5d7c823bfe6aa00a703a0ca75bfd1bbea9b479bbcb78f6
Instruction Fuzzy Hash: 71118121F18A4186F7608B52E89432972A4FBA8FE4F580275FA1DC77A8CF3CD444C750

Function 00007FF69E1983B0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,00007FF69E1933E6), ref: 00007FF69E1983DD
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF69E1933E6), ref: 00007FF69E19843A

Part of subcall function 00007FF69E1988F0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF69E193A24,00000000,00007FF69E191965), ref: 00007FF69E198929

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF69E1933E6), ref: 00007FF69E1984C5
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF69E1933E6), ref: 00007FF69E198524
FreeLibrary.KERNEL32(?,?,00000000,00007FF69E1933E6), ref: 00007FF69E198535
FreeLibrary.KERNEL32(?,?,00000000,00007FF69E1933E6), ref: 00007FF69E19854A

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 6ecb06d6968f6546db3bba2b41207f803a8ec0390fc4e9e0cb4ab4235174347d
Instruction ID: 6742e34d179bc4815a723c7647fcd7e8cd706aefac6c5ae8164cd3b7c9ec75e3
Opcode Fuzzy Hash: 6ecb06d6968f6546db3bba2b41207f803a8ec0390fc4e9e0cb4ab4235174347d
Instruction Fuzzy Hash: B441D0A2A1968241FA709B12B4846BA73A0FFA4BC4F444176EF8DD7789DF3CE444C724

Function 00007FF69E1AC168 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF69E1A5DF1,?,?,?,?,00007FF69E1AB332,?,?,?,?,00007FF69E1A806B), ref: 00007FF69E1AC177
FlsSetValue.KERNEL32(?,?,?,00007FF69E1A5DF1,?,?,?,?,00007FF69E1AB332,?,?,?,?,00007FF69E1A806B), ref: 00007FF69E1AC1AD
FlsSetValue.KERNEL32(?,?,?,00007FF69E1A5DF1,?,?,?,?,00007FF69E1AB332,?,?,?,?,00007FF69E1A806B), ref: 00007FF69E1AC1DA
FlsSetValue.KERNEL32(?,?,?,00007FF69E1A5DF1,?,?,?,?,00007FF69E1AB332,?,?,?,?,00007FF69E1A806B), ref: 00007FF69E1AC1EB
FlsSetValue.KERNEL32(?,?,?,00007FF69E1A5DF1,?,?,?,?,00007FF69E1AB332,?,?,?,?,00007FF69E1A806B), ref: 00007FF69E1AC1FC
SetLastError.KERNEL32(?,?,?,00007FF69E1A5DF1,?,?,?,?,00007FF69E1AB332,?,?,?,?,00007FF69E1A806B), ref: 00007FF69E1AC217

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6aa970e24f5ca119c8451d38d23d2f51b6f731ec3ce752582579c637f9f4275c
Instruction ID: 9d142a3ec202c5ed85bfb2a7b3aac49fe4868e6ce5271adeb59e057a1e49ca5d
Opcode Fuzzy Hash: 6aa970e24f5ca119c8451d38d23d2f51b6f731ec3ce752582579c637f9f4275c
Instruction Fuzzy Hash: 42119024F8C242C2FA79A36596C11391196DFA47B0F1807B5F83EC77E6DE2CE8498720

Function 00007FF69E1AA960 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF69E1AA985
GetProcAddress.KERNEL32 ref: 00007FF69E1AA99B
FreeLibrary.KERNEL32 ref: 00007FF69E1AA9C2

Strings

CorExitProcess, xrefs: 00007FF69E1AA994
mscoree.dll, xrefs: 00007FF69E1AA97C

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 418ea1e238ba9159b4af0c063643a1e1072a19be9fd93c352edfae4455fd553e
Instruction ID: 2c5660c85bf45fe57e6d6c9aa3a926440011415735a55c9d1b982705c89ca658
Opcode Fuzzy Hash: 418ea1e238ba9159b4af0c063643a1e1072a19be9fd93c352edfae4455fd553e
Instruction Fuzzy Hash: 43F06861F09A0241FB385B24E4843396360EF59761F980675E55EC53E8CF3CD049C320

Function 00007FF69E1BA578 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF69E1BA5A0
_set_statfp.LIBCMT ref: 00007FF69E1BA5BB
_set_statfp.LIBCMT ref: 00007FF69E1BA5D7
_set_statfp.LIBCMT ref: 00007FF69E1BA613

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 1ce3d9053971b9b3f9e89930d735954c283a7ecf3eea599db0e5d6da6a5aa185
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: A51151B2EACA0301F6741128D5E53761154EF783B4F4D46B6FA7E867DECE2CA9818120

Function 00007FF69E1AC230 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF69E1AB487,?,?,00000000,00007FF69E1AB722,?,?,?,?,?,00007FF69E1AB6AE), ref: 00007FF69E1AC24F
FlsSetValue.KERNEL32(?,?,?,00007FF69E1AB487,?,?,00000000,00007FF69E1AB722,?,?,?,?,?,00007FF69E1AB6AE), ref: 00007FF69E1AC26E
FlsSetValue.KERNEL32(?,?,?,00007FF69E1AB487,?,?,00000000,00007FF69E1AB722,?,?,?,?,?,00007FF69E1AB6AE), ref: 00007FF69E1AC296
FlsSetValue.KERNEL32(?,?,?,00007FF69E1AB487,?,?,00000000,00007FF69E1AB722,?,?,?,?,?,00007FF69E1AB6AE), ref: 00007FF69E1AC2A7
FlsSetValue.KERNEL32(?,?,?,00007FF69E1AB487,?,?,00000000,00007FF69E1AB722,?,?,?,?,?,00007FF69E1AB6AE), ref: 00007FF69E1AC2B8

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 55c2cfa3c6c0b66b4a1c6f957022f3ceea8d13f022cba7a3d54dd2efb067ed29
Instruction ID: 6c305c1716cbd242e258d8b1dd53bd1a3c202973ee6c08998aeb521a60e8c497
Opcode Fuzzy Hash: 55c2cfa3c6c0b66b4a1c6f957022f3ceea8d13f022cba7a3d54dd2efb067ed29
Instruction Fuzzy Hash: CE114220F8C24282F979A3A595D11791157DFB47B0F0843B5F83ED67E6DE2CE8498320

Function 00007FF69E1AC0C4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF69E1AC0D5
FlsSetValue.KERNEL32 ref: 00007FF69E1AC0F4
FlsSetValue.KERNEL32 ref: 00007FF69E1AC11C
FlsSetValue.KERNEL32 ref: 00007FF69E1AC12D
FlsSetValue.KERNEL32 ref: 00007FF69E1AC13E

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: ea3a9fca6980d96fa6a8d584e22936267001dce1870df9540930b962f91c0f75
Instruction ID: 99d35528ef7313f6011af12f6ced2ac1b6b7aa6e66ac6be61ad2d904aefeec39
Opcode Fuzzy Hash: ea3a9fca6980d96fa6a8d584e22936267001dce1870df9540930b962f91c0f75
Instruction Fuzzy Hash: 20112A14F88207C2F9B9632689D15791186CF64770F1807B8F83EDA2E2DE3CB8898270

Function 00007FF69E198330 Relevance: 7.5, APIs: 5, Instructions: 34sleepthreadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00007FF69E19833C
GetCurrentProcessId.KERNEL32 ref: 00007FF69E19834F
GetWindowThreadProcessId.USER32 ref: 00007FF69E19835F
ShowWindow.USER32 ref: 00007FF69E198376
Sleep.KERNEL32 ref: 00007FF69E198385

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: Window$Process$ConsoleCurrentShowSleepThread
String ID:
API String ID: 3908687701-0
Opcode ID: 189641115a4061fc09c8677c82cfa9183799967502c0d878e9acba3bff40d2a2
Instruction ID: 2631bce0a1d5582903559569f4a45745173225cc4b2472e1010279b5216f77a2
Opcode Fuzzy Hash: 189641115a4061fc09c8677c82cfa9183799967502c0d878e9acba3bff40d2a2
Instruction Fuzzy Hash: 8AF03131E18B4292FA685B22B4C453963A4EF64B84F0850B5FA4EC3769DE3DD5518720

Function 00007FF69E1A6F00 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A6F3C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A7066
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A711C

Strings

verbose, xrefs: 00007FF69E1A6F10

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
Instruction ID: add6a291c4f3a36273a66610a6e3939c2a7222ab7684526e015645b11450da3f
Opcode Fuzzy Hash: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
Instruction Fuzzy Hash: 3691DF22A48A4682F7719E24D89077E33D1EB61BA4F8441B6EA5DC33C5DF3CE9498361

Function 00007FF69E1B0DD8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B10B7

Part of subcall function 00007FF69E1A8918: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A8935

Strings

ccs, xrefs: 00007FF69E1B0FF2
UTF-16LEUNICODE, xrefs: 00007FF69E1B1055
UTF-8, xrefs: 00007FF69E1B1036

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 0f94fbfdb2a41be3f3cf5a79916f7e54565c06583a8995a71c4ffc2f48f318d6
Instruction ID: d60300d7f5b3da4b0241105312eef8563e5c39d5046d67c11f9ee131f21c6203
Opcode Fuzzy Hash: 0f94fbfdb2a41be3f3cf5a79916f7e54565c06583a8995a71c4ffc2f48f318d6
Instruction Fuzzy Hash: FD817376F0C242C6F7744E2681D02BD26A0EB31B84F5980B9FA49D73ADCF2DE9419761

Function 00007FF69E19CB78 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF69E19CBA3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF69E19CC3A
RtlUnwindEx.KERNEL32 ref: 00007FF69E19CC94

Strings

csm, xrefs: 00007FF69E19CC21

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: ef1879a6950a8d40b8b6b13be53b940b4e1f0e07f3723e86cdcfdad74941457a
Instruction ID: 6fbcea6444610385f66d8124e1062f96d05a2212c7a1413c241b25620d3af561
Opcode Fuzzy Hash: ef1879a6950a8d40b8b6b13be53b940b4e1f0e07f3723e86cdcfdad74941457a
Instruction Fuzzy Hash: 0F51AE32B196428ADB288F15F484A7C3B91FB64B98F548171FA8E87788DF3DE841C750

Function 00007FF69E19E7B8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF69E19E7E0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF69E19E8C8

Strings

csm, xrefs: 00007FF69E19E91A
csm, xrefs: 00007FF69E19E802

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 3d688b2030f6ff0abdfc3dd59f0c327938197cf645ae74c01235bdaf5d58afed
Instruction ID: 993223835417052a5b37089600eb6574bd41d91649fdc6724ef7df7644d7130b
Opcode Fuzzy Hash: 3d688b2030f6ff0abdfc3dd59f0c327938197cf645ae74c01235bdaf5d58afed
Instruction Fuzzy Hash: 8D519E329082428AEB748F25E08436877E0FB65B94F2451B5EA9D87BC5CF3CE4A0C711

Function 00007FF69E19E408 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF69E19E467
_CallSETranslator.LIBVCRUNTIME ref: 00007FF69E19E4B3

Strings

MOC, xrefs: 00007FF69E19E47B
RCC, xrefs: 00007FF69E19E483

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: edde39921f5ee52097c6895792b16df5fa6acf6af9cdc4a519cbf1eacb12af35
Instruction ID: de5f54e7fd9dcb79d51522d79ad0cd41f688b5de2abd027ee61c6b6dcbb0d7b4
Opcode Fuzzy Hash: edde39921f5ee52097c6895792b16df5fa6acf6af9cdc4a519cbf1eacb12af35
Instruction Fuzzy Hash: 22618F72908BC581EB709B15F4803AAB7A0FBA4B94F144265EB9D83B95DF7CE194CB10

Function 00007FF69E192220 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,00007FF69E19867F), ref: 00007FF69E19226E

Strings

WARNING, xrefs: 00007FF69E19227D
[PYI-%d:%ls] , xrefs: 00007FF69E192276
%ls, xrefs: 00007FF69E1922E5

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentProcess
String ID: %ls$WARNING$[PYI-%d:%ls]
API String ID: 2050909247-3372507544
Opcode ID: c23ec3862d6d49bee5b8e3278aef16b943e6e5a8136b4f67b876b2da5951f925
Instruction ID: 0b22dd5db00fad72970dc1f9ff5b36f88fb851a84f7ec66b76dd825eb050bd72
Opcode Fuzzy Hash: c23ec3862d6d49bee5b8e3278aef16b943e6e5a8136b4f67b876b2da5951f925
Instruction Fuzzy Hash: EA21CF22B18B8291E6309BA1F8856EA7365FF947C0F400176FA8D93B5ADF3CE255C750

Function 00007FF69E1AD440 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF69E1AD4BF
WriteFile.KERNEL32 ref: 00007FF69E1AD787
WriteFile.KERNEL32 ref: 00007FF69E1AD7CD
GetLastError.KERNEL32 ref: 00007FF69E1AD883

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 14e2902efc198ac46428043d17887fc0fe1e73f87b4a8b96d0a669f693f5166b
Instruction ID: c232f14fd40faaf0ef4159568e3a6837a4b0e579532874f3439aebb673e33fb8
Opcode Fuzzy Hash: 14e2902efc198ac46428043d17887fc0fe1e73f87b4a8b96d0a669f693f5166b
Instruction Fuzzy Hash: D1D1E172B08A8189E721CF65D4802BC37B1FB647ECB044275EE5E97B99DE38E45AC310

Function 00007FF69E1B6D2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E1B2970: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B29A3

_get_daylight.LIBCMT ref: 00007FF69E1B6E44
_get_daylight.LIBCMT ref: 00007FF69E1B6E55

Strings

?, xrefs: 00007FF69E1B6DD5

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: ea27d5bab428f8d08876b527b76b9e577d8d7331fbc1e16d258a527e235e04e0
Instruction ID: 970915b5be512e81350dd9cfd3e0e6b94846651b774bef8d291ea558a66c3e4d
Opcode Fuzzy Hash: ea27d5bab428f8d08876b527b76b9e577d8d7331fbc1e16d258a527e235e04e0
Instruction Fuzzy Hash: E8410722E1868242FB749B25D48177A66A0EBB0BA4F184275FF9D86BDDDF3CD481C710

Function 00007FF69E1A9EF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A9F22

Part of subcall function 00007FF69E1AB404: RtlFreeHeap.NTDLL(?,?,?,00007FF69E1B3F32,?,?,?,00007FF69E1B3F6F,?,?,00000000,00007FF69E1B4435,?,?,?,00007FF69E1B4367), ref: 00007FF69E1AB41A
Part of subcall function 00007FF69E1AB404: GetLastError.KERNEL32(?,?,?,00007FF69E1B3F32,?,?,?,00007FF69E1B3F6F,?,?,00000000,00007FF69E1B4435,?,?,?,00007FF69E1B4367), ref: 00007FF69E1AB424

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF69E19C105), ref: 00007FF69E1A9F40

Strings

C:\Users\user\Desktop\grass.exe, xrefs: 00007FF69E1A9F2E

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\grass.exe
API String ID: 3580290477-4084898051
Opcode ID: bc01061c4cc8c91eee370674af58ee8194fcae9dda6430c35c80b2c7cc3d28c8
Instruction ID: 6d44bf77e14285abafdc9ac38e02224f076018789e3b8308e0216a6be7122d6c
Opcode Fuzzy Hash: bc01061c4cc8c91eee370674af58ee8194fcae9dda6430c35c80b2c7cc3d28c8
Instruction Fuzzy Hash: 26418036A48B5285EB34DF25A4C00BD27A4FF547A4F544076FA4E83B86DF3DE4898320

Function 00007FF69E1ADAD8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF69E1ADBEF
GetLastError.KERNEL32 ref: 00007FF69E1ADC11

Strings

U, xrefs: 00007FF69E1ADB9B

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 797531766008a18f3c3f2ebfc764013bb0aa63053139a0e0a3037f6d78866fb3
Instruction ID: fbc0776132b553338a9f86c31e9d5c650dc1af2721c26ae15bcd6905e6c92915
Opcode Fuzzy Hash: 797531766008a18f3c3f2ebfc764013bb0aa63053139a0e0a3037f6d78866fb3
Instruction Fuzzy Hash: AF41B122A18A9181EB20CF25E4843B967A0FBA8798F854035FE4EC7798DF7CD445C750

Function 00007FF69E192020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF69E191B4A), ref: 00007FF69E192070

Strings

[PYI-%d:ERROR] , xrefs: 00007FF69E192078
%s: %s, xrefs: 00007FF69E1920EF

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$[PYI-%d:ERROR]
API String ID: 2050909247-3704582800
Opcode ID: ebe6697f12ad02503cffa64283aecd79278313c21e34cf74a6abe378b8759c19
Instruction ID: 9758bedc366be7e89579cfaa62dd0d6d9545e157e341cf0f24a374aadac33e2c
Opcode Fuzzy Hash: ebe6697f12ad02503cffa64283aecd79278313c21e34cf74a6abe378b8759c19
Instruction Fuzzy Hash: 77210223B1868145E7309761B8816FA6295FF98BD4F410172FE8DD3B89DF3CE186C210

Function 00007FF69E1B07C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF69E1B0808
GetCurrentDirectoryW.KERNEL32 ref: 00007FF69E1B085A

Strings

:, xrefs: 00007FF69E1B081E

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 576b735185a232e7c4c7703006db41f83a331aa74a964717a1a8a85435f6eb25
Instruction ID: ded3c7366be19741dbcbd5a07cc5c83c0ee3934a732b7d951f0f4d6c1c252ab5
Opcode Fuzzy Hash: 576b735185a232e7c4c7703006db41f83a331aa74a964717a1a8a85435f6eb25
Instruction Fuzzy Hash: 1421A562E08681C1EB349B16D48427D73A1FB94B84F498075E68D83799DFBCDA85C7A0

Function 00007FF69E191E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF69E191B79), ref: 00007FF69E191E9E

Strings

[PYI-%d:%s] , xrefs: 00007FF69E191EA6
ERROR, xrefs: 00007FF69E191EAD

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$[PYI-%d:%s]
API String ID: 2050909247-3005936843
Opcode ID: a5bf08f2c89cf667238edf45a936573bde058e15704574c9bcaf5d59603a2596
Instruction ID: da0520a20ce22da2f6ca8cb5c056340de4c594debdfa72e9f3b8cc57cd6d8c33
Opcode Fuzzy Hash: a5bf08f2c89cf667238edf45a936573bde058e15704574c9bcaf5d59603a2596
Instruction Fuzzy Hash: D8118E32B18B8181E6309B61B8C16EA73A4EB947C4F400176FA8D93B59EE7CD1958714

Function 00007FF69E192140 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF69E1928DA,FFFFFFFF,00000000,00007FF69E19336A), ref: 00007FF69E19218E

Strings

[PYI-%d:%s] , xrefs: 00007FF69E192196
WARNING, xrefs: 00007FF69E19219D

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentProcess
String ID: WARNING$[PYI-%d:%s]
API String ID: 2050909247-3752221249
Opcode ID: db875de87ed083cbe8b8ac9ce96a8a46b9823338c5ab1c0f8249dfcf38eaa236
Instruction ID: 8fc044963058e2536cb6adda4b969ae30a5ca43f7872cbcbe00eb8545b242507
Opcode Fuzzy Hash: db875de87ed083cbe8b8ac9ce96a8a46b9823338c5ab1c0f8249dfcf38eaa236
Instruction Fuzzy Hash: BC118E32A18B8181E6309B61B8C16EA73A4FB987C4F400176FA8D93B59DF7CD1958714

Function 00007FF69E19F278 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF69E19F2C8
RaiseException.KERNEL32 ref: 00007FF69E19F309

Strings

csm, xrefs: 00007FF69E19F2F6

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 2d92b8b7d521df9494866c30e4ae755c0f7892732a35e9ef4a1741b3f71c7287
Instruction ID: d28bd89574285bf1e825e74f08e7856a7fc4ed939155c2a785c0eadfd71ba659
Opcode Fuzzy Hash: 2d92b8b7d521df9494866c30e4ae755c0f7892732a35e9ef4a1741b3f71c7287
Instruction Fuzzy Hash: B9111C36A18B8582EB658F15F48026977E4FB98B84F684270EE9D47758DF3CD551C700

Function 00007FF69E1B194C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B197C
GetDriveTypeW.KERNEL32 ref: 00007FF69E1B19BC

Strings

:, xrefs: 00007FF69E1B19A5

Memory Dump Source

Source File: 00000000.00000002.2627677747.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000000.00000002.2627658235.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627705029.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627727908.00007FF69E1D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2627769092.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e190000_grass.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: bb470fc7cf78428f0d9dc0079e6dc4031c2c99e910ba5258b42cac156009a768
Instruction ID: 30f76b72de994c0e9115f6f19fba502d2d209dde129ea87edde51e55726596fc
Opcode Fuzzy Hash: bb470fc7cf78428f0d9dc0079e6dc4031c2c99e910ba5258b42cac156009a768
Instruction Fuzzy Hash: 89018F22E1C246C6F734AF60A4A127E63A0EF64744F850075F94EC6799DF3CE544CB24

Analysis Process: grass.exePID: 7664, Parent PID: 7552COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.5%
Total number of Nodes:	1330
Total number of Limit Nodes:	48

Executed Functions

Function 61CC5080 Relevance: 118.4, APIs: 58, Strings: 9, Instructions: 1172COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON310 ref: 61CC5147
PyErr_Format.PYTHON310 ref: 61CC51AF
PyErr_Format.PYTHON310 ref: 61CC5210
PyErr_Format.PYTHON310 ref: 61CC5273

Strings

OOy#|i, xrefs: 61CC534A
<frozen %U>, xrefs: 61CC54B1, 61CC5501
__main__, xrefs: 61CC58C8
000000, xrefs: 61CC5670
hdinfo, xrefs: 61CC56A5
__spec__, xrefs: 61CC592D
__mp_main__, xrefs: 61CC58EE
keyinfo, xrefs: 61CC55BA
%s (%d:%d), xrefs: 61CC5140, 61CC51A8, 61CC5209, 61CC526C, 61CC546F, 61CC5584, 61CC5E7C, 61CC6124, 61CC619C, 61CC61F1

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_Format
String ID: %s (%d:%d)$000000$<frozen %U>$OOy#|i$__main__$__mp_main__$__spec__$hdinfo$keyinfo
API String ID: 376477240-58712055
Opcode ID: aa9977c45e3ec006dbacf3bafae9c48ff1d6dd02bcb06f05158bdefab51a51da
Instruction ID: 063dd571ca6a22fcfd0d57ecd5faa1ba3fbe2b7da7f0738fefe1ffdfc180a505
Opcode Fuzzy Hash: aa9977c45e3ec006dbacf3bafae9c48ff1d6dd02bcb06f05158bdefab51a51da
Instruction Fuzzy Hash: 73B24A72705B90C5EB158F6AE8903AD3BA2F785F88F498126CE5D47768EF39C851C342

Function 61CC6530 Relevance: 118.2, APIs: 51, Strings: 16, Instructions: 915librarystringloaderCOMMON

Download Yara Rule

APIs

PySys_GetObject.PYTHON310 ref: 61CC6551
PyTuple_GetItem.PYTHON310 ref: 61CC656B
PyLong_AsLong.PYTHON310 ref: 61CC6580
PyTuple_GetItem.PYTHON310 ref: 61CC6590
PyLong_AsLong.PYTHON310 ref: 61CC659E
PySys_GetObject.PYTHON310 ref: 61CC65AD
PyLong_AsVoidPtr.PYTHON310 ref: 61CC65B9
GetProcAddress.KERNEL32 ref: 61CC65DE
GetProcAddress.KERNEL32 ref: 61CC65FC
GetProcAddress.KERNEL32 ref: 61CC661A
PyModule_Create2.PYTHON310 ref: 61CC6644
PyModule_GetName.PYTHON310 ref: 61CC6659
strrchr.MSVCRT ref: 61CC667E
malloc.MSVCRT ref: 61CC6694
memcpy.MSVCRT ref: 61CC66AE
PyBytes_FromStringAndSize.PYTHON310 ref: 61CC6701
PyBytes_AsString.PYTHON310 ref: 61CC671B
malloc.MSVCRT ref: 61CC672F
PyCMethod_New.PYTHON310 ref: 61CC677D
PyCMethod_New.PYTHON310 ref: 61CC67C3
PyCMethod_New.PYTHON310 ref: 61CC6809
PyBytes_FromStringAndSize.PYTHON310 ref: 61CC6833
PyBytes_AsString.PYTHON310 ref: 61CC6849
_time64.MSVCRT ref: 61CC6926
srand.MSVCRT ref: 61CC692E
strstr.MSVCRT ref: 61CC6AD5
strncmp.MSVCRT ref: 61CC6B11
PyErr_Format.PYTHON310 ref: 61CC6B84
_Py_Dealloc.PYTHON310 ref: 61CC6BBA
_Py_Dealloc.PYTHON310 ref: 61CC6BC9
malloc.MSVCRT ref: 61CC6BEA
free.MSVCRT ref: 61CC6C54
malloc.MSVCRT ref: 61CC6C60
memcpy.MSVCRT ref: 61CC6C83
free.MSVCRT ref: 61CC6CB2
malloc.MSVCRT ref: 61CC6CBE
memcpy.MSVCRT ref: 61CC6CE1
PyErr_Format.PYTHON310 ref: 61CC7328

Part of subcall function 61CDE5E0: memcmp.MSVCRT ref: 61CDE613
Part of subcall function 61CDE5E0: memcmp.MSVCRT ref: 61CDE630
Part of subcall function 61CDE5E0: memcmp.MSVCRT ref: 61CDE652
Part of subcall function 61CDE5E0: memcmp.MSVCRT ref: 61CDE672
Part of subcall function 61CDE5E0: memcmp.MSVCRT ref: 61CDE692
Part of subcall function 61CDE5E0: memcmp.MSVCRT ref: 61CDE6B2
Part of subcall function 61CDE5E0: memcmp.MSVCRT ref: 61CDE6D2
Part of subcall function 61CDE5E0: memcmp.MSVCRT ref: 61CDE6F2

Part of subcall function 61CDE350: memcmp.MSVCRT ref: 61CDE383
Part of subcall function 61CDE350: memcmp.MSVCRT ref: 61CDE3A3
Part of subcall function 61CDE350: memcmp.MSVCRT ref: 61CDE3C5
Part of subcall function 61CDE350: memcmp.MSVCRT ref: 61CDE3E5
Part of subcall function 61CDE350: memcmp.MSVCRT ref: 61CDE405
Part of subcall function 61CDE350: memcmp.MSVCRT ref: 61CDE425
Part of subcall function 61CDE350: memcmp.MSVCRT ref: 61CDE445
Part of subcall function 61CDE350: memcmp.MSVCRT ref: 61CDE465

Part of subcall function 61CDDD80: strcmp.MSVCRT ref: 61CDDDAB
Part of subcall function 61CDDD80: strcmp.MSVCRT ref: 61CDDDD5
Part of subcall function 61CDDD80: strcmp.MSVCRT ref: 61CDDDF4
Part of subcall function 61CDDD80: strcmp.MSVCRT ref: 61CDDE13
Part of subcall function 61CDDD80: strcmp.MSVCRT ref: 61CDDE32
Part of subcall function 61CDDD80: strcmp.MSVCRT ref: 61CDDE4D
Part of subcall function 61CDDD80: strcmp.MSVCRT ref: 61CDDE68
Part of subcall function 61CDDD80: strcmp.MSVCRT ref: 61CDDE83

Part of subcall function 61CDE020: strcmp.MSVCRT ref: 61CDE04B
Part of subcall function 61CDE020: strcmp.MSVCRT ref: 61CDE06F
Part of subcall function 61CDE020: strcmp.MSVCRT ref: 61CDE08B
Part of subcall function 61CDE020: strcmp.MSVCRT ref: 61CDE0AA
Part of subcall function 61CDE020: strcmp.MSVCRT ref: 61CDE0C9
Part of subcall function 61CDE020: strcmp.MSVCRT ref: 61CDE0E4
Part of subcall function 61CDE020: strcmp.MSVCRT ref: 61CDE0FF
Part of subcall function 61CDE020: strcmp.MSVCRT ref: 61CDE11A

Part of subcall function 61CDDED0: strcmp.MSVCRT ref: 61CDDEFB
Part of subcall function 61CDDED0: strcmp.MSVCRT ref: 61CDDF25
Part of subcall function 61CDDED0: strcmp.MSVCRT ref: 61CDDF44
Part of subcall function 61CDDED0: strcmp.MSVCRT ref: 61CDDF63
Part of subcall function 61CDDED0: strcmp.MSVCRT ref: 61CDDF82
Part of subcall function 61CDDED0: strcmp.MSVCRT ref: 61CDDF9D
Part of subcall function 61CDDED0: strcmp.MSVCRT ref: 61CDDFB8
Part of subcall function 61CDDED0: strcmp.MSVCRT ref: 61CDDFD3

PyBytes_AsStringAndSize.PYTHON310 ref: 61CC6E58

Strings

C_ASSERT_ARMORED_INDEX, xrefs: 61CC6744
PyCell_New, xrefs: 61CC65E3
version_info, xrefs: 61CC6543
.pyarmor.ikey, xrefs: 61CC6E30
C_ENTER_CO_OBJECT_INDEX, xrefs: 61CC679B
pyarmor_runtime_, xrefs: 61CC6AC9, 61CC6AE5
PyCell_Set, xrefs: 61CC6601
sha256, xrefs: 61CC69C5
%s (%d:%d), xrefs: 61CC6B7D, 61CC6DA5, 61CC6E14, 61CC6F85, 61CC72BD, 61CC7321
dllhandle, xrefs: 61CC65A0
sprng, xrefs: 61CC69AB
PyCell_Get, xrefs: 61CC65D7
C_LEAVE_CO_OBJECT_INDEX, xrefs: 61CC67E1
000000, xrefs: 61CC6B04
,*, xrefs: 61CC7313
aes, xrefs: 61CC6991

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: strcmp$memcmp$Bytes_Stringmalloc$AddressLong_Method_ProcSizememcpy$DeallocErr_FormatFromItemLongModule_ObjectSys_Tuple_free$Create2NameVoid_time64srandstrncmpstrrchrstrstr
String ID: %s (%d:%d)$,*$.pyarmor.ikey$000000$C_ASSERT_ARMORED_INDEX$C_ENTER_CO_OBJECT_INDEX$C_LEAVE_CO_OBJECT_INDEX$PyCell_Get$PyCell_New$PyCell_Set$aes$dllhandle$pyarmor_runtime_$sha256$sprng$version_info
API String ID: 3695841847-3717260241
Opcode ID: 57beb1e1c9b7b7de6b58cbfc37ee6c83c64c1df4fff32cda8d69c18b73152b7c
Instruction ID: b0cc22fa1ac255a693f4ffd26fc2946e98255802dc628caa3e472846c4b34fb4
Opcode Fuzzy Hash: 57beb1e1c9b7b7de6b58cbfc37ee6c83c64c1df4fff32cda8d69c18b73152b7c
Instruction Fuzzy Hash: E682F172701B94C2EB01CB65E5547AE3BA2FB85F88F49C016CA4E4B794EF39D915C342

Function 00007FFB0BC2220C Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB0BC44DED
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB0BC44E3F
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB0BC44E64

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB0BC44DE3, 00007FFB0BC44E2F, 00007FFB0BC44E4F, 00007FFB0BC44E8E, 00007FFB0BC44EEE, 00007FFB0BC44F14, 00007FFB0BC450A3
TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256, xrefs: 00007FFB0BC44F95
ALL:!COMPLEMENTOFDEFAULT:!eNULL, xrefs: 00007FFB0BC44FC7
ssl3-sha1, xrefs: 00007FFB0BC4502F
ssl3-md5, xrefs: 00007FFB0BC45007

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c$ALL:!COMPLEMENTOFDEFAULT:!eNULL$TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$ssl3-md5$ssl3-sha1
API String ID: 1767461275-1115027282
Opcode ID: 3645f380145c2284706b6986e079d24ed93b2d98b1f158f8d20cddb3902bffaf
Instruction ID: 6c9f55a3fc3fcd6a35fc11e37b665a5c9172ba230694052c811fd91b4008937f
Opcode Fuzzy Hash: 3645f380145c2284706b6986e079d24ed93b2d98b1f158f8d20cddb3902bffaf
Instruction Fuzzy Hash: 6FA13FB1A09B43A1FB68DF35D551BA97290EF44748F588135DA4E8BBA6EF3CE604C310

Function 00007FF69E1B7B74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF69E1B78A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B78E9
Part of subcall function 00007FF69E1B78A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B7967
Part of subcall function 00007FF69E1B78A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B79B8

CreateFileW.KERNEL32 ref: 00007FF69E1B7C7A
CreateFileW.KERNEL32 ref: 00007FF69E1B7CCA
GetLastError.KERNEL32 ref: 00007FF69E1B7CFA
GetFileType.KERNEL32 ref: 00007FF69E1B7D0F
GetLastError.KERNEL32 ref: 00007FF69E1B7D19
CloseHandle.KERNEL32 ref: 00007FF69E1B7D4C
CloseHandle.KERNEL32 ref: 00007FF69E1B7EAF
CreateFileW.KERNEL32 ref: 00007FF69E1B7EE4
GetLastError.KERNEL32 ref: 00007FF69E1B7EF3

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 6900b12a6c6c443aa41c68e268e6275e38d412fb7e8bb922b7a0c5fbdd2459d5
Instruction ID: d188ba02dc684ec1d486227a47d4799b605f5a00b0fd577e40c4c05f8d2b96b3
Opcode Fuzzy Hash: 6900b12a6c6c443aa41c68e268e6275e38d412fb7e8bb922b7a0c5fbdd2459d5
Instruction Fuzzy Hash: B2C1B136F28A4286EB24CF68D4D06BC3761EB59BA8B055375EE1E9B798CF38D055C310

Function 00007FF69E1987E0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF69E198813
FindClose.KERNEL32 ref: 00007FF69E198822

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: bf04df12ed89424385b35bc97b9e30209b4e9d30cb3ee9ccc1531a0517fd62e7
Instruction ID: 6d5c183bf86fe30d3a90fde70c2eccabb46cb81ed2faf2ca9a97094eaff7809d
Opcode Fuzzy Hash: bf04df12ed89424385b35bc97b9e30209b4e9d30cb3ee9ccc1531a0517fd62e7
Instruction Fuzzy Hash: DEF0C226A1C64686F7B08B64F4C876A7390FB94764F04433AFA6E426D4DF3CD049CB10

Function 00007FFB0B99DDDC Relevance: 198.4, APIs: 77, Strings: 36, Instructions: 650COMMON

Download Yara Rule

APIs

PyType_Ready.PYTHON310 ref: 00007FFB0B99DF12
PyType_Ready.PYTHON310 ref: 00007FFB0B99DF27
PyType_Ready.PYTHON310 ref: 00007FFB0B99DF3C
PyType_Ready.PYTHON310 ref: 00007FFB0B99DF51
PyUnicode_FromString.PYTHON310 ref: 00007FFB0B99DF66
PyDict_SetItemString.PYTHON310 ref: 00007FFB0B99DF89
PyDict_SetItemString.PYTHON310 ref: 00007FFB0B99DFA8
PyImport_ImportModule.PYTHON310 ref: 00007FFB0B99DFC7
PyObject_GetAttrString.PYTHON310 ref: 00007FFB0B99DFE3
PyObject_CallMethod.PYTHON310 ref: 00007FFB0B99E00D
PyObject_GetAttrString.PYTHON310 ref: 00007FFB0B99E030
PyImport_ImportModule.PYTHON310 ref: 00007FFB0B99E061
PyObject_CallMethod.PYTHON310 ref: 00007FFB0B99E097
PyUnicode_FromString.PYTHON310 ref: 00007FFB0B99E0B4
PyDict_SetItemString.PYTHON310 ref: 00007FFB0B99E0DE
PyImport_ImportModule.PYTHON310 ref: 00007FFB0B99E0FD
PyObject_GetAttrString.PYTHON310 ref: 00007FFB0B99E119
PyObject_CallFunction.PYTHON310 ref: 00007FFB0B99E14C
PyModule_Create2.PYTHON310 ref: 00007FFB0B99E19E
PyModule_AddObject.PYTHON310 ref: 00007FFB0B99E1C8
PyModule_AddObject.PYTHON310 ref: 00007FFB0B99E1EE
PyModule_AddObject.PYTHON310 ref: 00007FFB0B99E210
PyErr_NewException.PYTHON310 ref: 00007FFB0B99E232
PyModule_AddObject.PYTHON310 ref: 00007FFB0B99E258
PyTuple_New.PYTHON310 ref: 00007FFB0B99E26B
PyTuple_Pack.PYTHON310 ref: 00007FFB0B99E2C7
PyErr_NewException.PYTHON310 ref: 00007FFB0B99E2E3
PyModule_AddObject.PYTHON310 ref: 00007FFB0B99E30F
PyTuple_Pack.PYTHON310 ref: 00007FFB0B99E379
PyErr_NewException.PYTHON310 ref: 00007FFB0B99E395
PyModule_AddObject.PYTHON310 ref: 00007FFB0B99E3C1
PyObject_CallObject.PYTHON310 ref: 00007FFB0B99E3EE
PyModule_AddObject.PYTHON310 ref: 00007FFB0B99E414
PyContextVar_New.PYTHON310 ref: 00007FFB0B99E42B
PyModule_AddObject.PYTHON310 ref: 00007FFB0B99E45C
PyModule_AddObject.PYTHON310 ref: 00007FFB0B99E485
PyObject_CallObject.PYTHON310 ref: 00007FFB0B99E498
PyModule_AddObject.PYTHON310 ref: 00007FFB0B99E523
PyObject_CallObject.PYTHON310 ref: 00007FFB0B99E536
PyModule_AddObject.PYTHON310 ref: 00007FFB0B99E59C
PyLong_FromSsize_t.PYTHON310 ref: 00007FFB0B99E5BE
PyModule_AddObject.PYTHON310 ref: 00007FFB0B99E5D9
PyUnicode_InternFromString.PYTHON310 ref: 00007FFB0B99E61C
PyModule_AddObject.PYTHON310 ref: 00007FFB0B99E64B
PyModule_AddStringConstant.PYTHON310 ref: 00007FFB0B99E67C
PyModule_AddStringConstant.PYTHON310 ref: 00007FFB0B99E69E
PyTuple_Pack.PYTHON310 ref: 00007FFB0B99E6E3
PyTuple_Pack.PYTHON310 ref: 00007FFB0B99E708
PyTuple_Pack.PYTHON310 ref: 00007FFB0B99E73B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFB0B9A6F2B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFB0B9A6F52
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFB0B9A6F6C
fputc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFB0B9A6F7A

Part of subcall function 00007FFB0B99E748: PyErr_Format.PYTHON310(?,?,?,?,00007FFB0B99DEB5), ref: 00007FFB0B9A71B4

_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A6F89
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A6F98
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A6FA7
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A6FB6
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A6FC5
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A6FD1
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A6FDD
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A6FE9
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A6FF8
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A7041
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A7068
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A7087
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A709C
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A70B0
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A70C4
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A70E3
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A7102
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A7121
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A7140
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A715F
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A717E
_Py_Dealloc.PYTHON310 ref: 00007FFB0B9A7192

Strings

__libmpdec_version__, xrefs: 00007FFB0B99E694
collections.abc, xrefs: 00007FFB0B99E0F6
HAVE_CONTEXTVAR, xrefs: 00007FFB0B99E448
Number, xrefs: 00007FFB0B99DFD9
s(OO){}, xrefs: 00007FFB0B99E145
sign digits exponent, xrefs: 00007FFB0B99E073
D:\a\1\s\Modules\_decimal\libmpdec\context.c, xrefs: 00007FFB0B9A6F37
decimal, xrefs: 00007FFB0B99DF5F, 00007FFB0B99E0AD
numbers, xrefs: 00007FFB0B99DFC0
HAVE_THREADS, xrefs: 00007FFB0B99E471
__version__, xrefs: 00007FFB0B99E675
mpd_setminalloc: ignoring request to set MPD_MINALLOC a second time, xrefs: 00007FFB0B9A6F5B
%s:%d: warning: , xrefs: 00007FFB0B9A6F41
DecimalException, xrefs: 00007FFB0B99E24B
ExtendedContext, xrefs: 00007FFB0B99E560
as_integer_ratio, xrefs: 00007FFB0B99DEA9
MutableMapping, xrefs: 00007FFB0B99E10F
decimal_context, xrefs: 00007FFB0B99E424
X, xrefs: 00007FFB0B99E281
bit_length, xrefs: 00007FFB0B99DECC
register, xrefs: 00007FFB0B99E006
SignalDict, xrefs: 00007FFB0B99E139
Rational, xrefs: 00007FFB0B99E026
(ss), xrefs: 00007FFB0B99E089
DefaultContext, xrefs: 00007FFB0B99E407
Decimal, xrefs: 00007FFB0B99E1BE
BasicContext, xrefs: 00007FFB0B99E4C7
2.5.1, xrefs: 00007FFB0B99E68A
(O), xrefs: 00007FFB0B99DFFF
decimal.DecimalException, xrefs: 00007FFB0B99E225
__module__, xrefs: 00007FFB0B99DF7F, 00007FFB0B99DF9E, 00007FFB0B99E0CD
Context, xrefs: 00007FFB0B99E1E4
collections, xrefs: 00007FFB0B99E05A
1.70, xrefs: 00007FFB0B99E66B
namedtuple, xrefs: 00007FFB0B99E090
DecimalTuple, xrefs: 00007FFB0B99E07D, 00007FFB0B99E203

Memory Dump Source

Source File: 00000003.00000002.2629889219.00007FFB0B981000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFB0B980000, based on PE: true

Associated: 00000003.00000002.2629873832.00007FFB0B980000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.2629916648.00007FFB0B9A9000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.2629934037.00007FFB0B9B7000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.2629947883.00007FFB0B9B8000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.2630002819.00007FFB0B9B9000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.2630020492.00007FFB0B9BA000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0b980000_grass.jbxd

Similarity

API ID: Dealloc$Module_Object$String$Object_$CallTuple_$Pack$Err_FromReadyType_$AttrDict_ExceptionImportImport_ItemModuleUnicode___acrt_iob_func$ConstantMethod$ContextCreate2FormatFunctionInternLong_Ssize_tVar_fputc
String ID: %s:%d: warning: $(O)$(ss)$1.70$2.5.1$BasicContext$Context$D:\a\1\s\Modules\_decimal\libmpdec\context.c$Decimal$DecimalException$DecimalTuple$DefaultContext$ExtendedContext$HAVE_CONTEXTVAR$HAVE_THREADS$MutableMapping$Number$Rational$SignalDict$X$__libmpdec_version__$__module__$__version__$as_integer_ratio$bit_length$collections$collections.abc$decimal$decimal.DecimalException$decimal_context$mpd_setminalloc: ignoring request to set MPD_MINALLOC a second time$namedtuple$numbers$register$s(OO){}$sign digits exponent
API String ID: 2210023312-1398799035
Opcode ID: c1ff8ca14523f96089b7d5b9a0d8bd12967f953275509cce669ba4746d8d11dd
Instruction ID: 08d26f1ebf25715f543a3456581080ff8d327a3cb59d5a1b87155a189b113fc4
Opcode Fuzzy Hash: c1ff8ca14523f96089b7d5b9a0d8bd12967f953275509cce669ba4746d8d11dd
Instruction Fuzzy Hash: 516205A1E09B1382FA549B75E954EB833A4BF89B84F04C175DA0F963B4DF7DA844C380

Function 00007FF69E191000 Relevance: 61.8, APIs: 3, Strings: 32, Instructions: 529COMMON

Download Yara Rule

Strings

pyi-python-flag, xrefs: 00007FF69E192EA0
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF69E192EFC
hide-early, xrefs: 00007FF69E192F91
Failed to remove temporary directory: %s, xrefs: 00007FF69E193404
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF69E193302
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF69E192D9E
pyi-contents-directory, xrefs: 00007FF69E192F58
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF69E192C43, 00007FF69E192C6F
_PYI_ARCHIVE_FILE, xrefs: 00007FF69E192C92, 00007FF69E192DC0
pkg, xrefs: 00007FF69E192D7E
hide-late, xrefs: 00007FF69E192FCB
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF69E192D31
pyi-runtime-tmpdir, xrefs: 00007FF69E192F33
pyi-hide-console, xrefs: 00007FF69E192F7D
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF69E19317B
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF69E193250
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF69E1932ED
Failed to load splash screen resources!, xrefs: 00007FF69E1932CC
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF69E1930A5
VCRUNTIME140.dll, xrefs: 00007FF69E1931F7
minimize-late, xrefs: 00007FF69E192FE8
MEI, xrefs: 00007FF69E192CF3
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF69E192DCC, 00007FF69E19311A, 00007FF69E1933A0
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF69E193158
Failed to start splash screen!, xrefs: 00007FF69E19331B
Could not create temporary directory!, xrefs: 00007FF69E193105
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF69E193043
Py_GIL_DISABLED, xrefs: 00007FF69E192EBE
minimize-early, xrefs: 00007FF69E192FAE
_PYI_SPLASH_IPC, xrefs: 00007FF69E192DE4, 00007FF69E19333C
Failed to convert DLL search path!, xrefs: 00007FF69E193222
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF69E192DD8, 00007FF69E192DF0, 00007FF69E192E5C

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$hide-early$hide-late$minimize-early$minimize-late$pkg$pyi-contents-directory$pyi-hide-console$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-3325264605
Opcode ID: e3c9e3186ddb46232941edcda19b8474144587cd7e76f5bca59973997f4db7cf
Instruction ID: 20d76ad72b4621590f020c6df664e0134a8dfc8d53bc4db9112961887c4279a3
Opcode Fuzzy Hash: e3c9e3186ddb46232941edcda19b8474144587cd7e76f5bca59973997f4db7cf
Instruction Fuzzy Hash: C0424F21E0C68291FB399B21B4D52F96691EF75784F8840B2F95EC62D6EF2CE549C320

Function 00007FF69E191930 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF69E1973F0: _fread_nolock.LIBCMT ref: 00007FF69E19749A

_fread_nolock.LIBCMT ref: 00007FF69E1919FB

Part of subcall function 00007FF69E192020: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF69E191B4A), ref: 00007FF69E192070

Strings

Could not allocate buffer for TOC!, xrefs: 00007FF69E191AFB
fseek, xrefs: 00007FF69E1919D5
malloc, xrefs: 00007FF69E191B02
Could not allocate memory for archive structure!, xrefs: 00007FF69E191A41
Failed to read cookie!, xrefs: 00007FF69E191A0B
Error on file., xrefs: 00007FF69E191B6D
Could not read full TOC!, xrefs: 00007FF69E191B35
Failed to seek to cookie position!, xrefs: 00007FF69E1919CE
fread, xrefs: 00007FF69E191A12, 00007FF69E191B3C
calloc, xrefs: 00007FF69E191A48
MEI, xrefs: 00007FF69E191971

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 6f0fb0282e10422f888bdd4acf5062c6714093283ab30dc9baf7ea4e7ee44d87
Instruction ID: 2d69f020cdce0ad996588d4f8f1ae6404505359ceeb2cca558552a3bd21b289f
Opcode Fuzzy Hash: 6f0fb0282e10422f888bdd4acf5062c6714093283ab30dc9baf7ea4e7ee44d87
Instruction Fuzzy Hash: 6D816E71B0968295EB789B24E0C43B923A1FF68784F444076F98EC7799DE3CE5858760

Function 61CE03D0 Relevance: 21.3, APIs: 9, Strings: 5, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 61CE04AC
free.MSVCRT ref: 61CE0504
malloc.MSVCRT ref: 61CE053C
free.MSVCRT ref: 61CE0591
free.MSVCRT ref: 61CE059B
memcmp.MSVCRT ref: 61CE068D
memcmp.MSVCRT ref: 61CE0852
memcmp.MSVCRT ref: 61CE087B
free.MSVCRT ref: 61CE0890

Strings

stat != NULL, xrefs: 61CE0640
src/pk/rsa/rsa_verify_hash.c, xrefs: 61CE0620, 61CE0639, 61CE0652, 61CE066B
hash != NULL, xrefs: 61CE0672
key != NULL, xrefs: 61CE0627
sig != NULL, xrefs: 61CE0659

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: free$memcmp$malloc
String ID: hash != NULL$key != NULL$sig != NULL$src/pk/rsa/rsa_verify_hash.c$stat != NULL
API String ID: 2896619906-237625700
Opcode ID: 081dea31bdf5f5099bf901d4ea042abd2c802e1258e2705553ed9b2c2f5f3434
Instruction ID: 300d92e884d16b6660fc0541407657602f25cae0dca6aeb14bb9d647f31fcb00
Opcode Fuzzy Hash: 081dea31bdf5f5099bf901d4ea042abd2c802e1258e2705553ed9b2c2f5f3434
Instruction Fuzzy Hash: E9B16972208681CAE720CF52E54879EBBA0F385788F548516DE8987B58EF7DC469CF90

Function 61CDCA30 Relevance: 14.7, APIs: 4, Strings: 5, Instructions: 1167COMMON

Download Yara Rule

Strings

d != NULL, xrefs: 61CDCB7E, 61CDCC2E, 61CDD33E, 61CDD6AE
b != NULL, xrefs: 61CDCBB0, 61CDCC60, 61CDCD01, 61CDCF40, 61CDCFAA, 61CDD01B, 61CDD088, 61CDD0F8, 61CDD15C, 61CDD1C8, 61CDD26A, 61CDD370, 61CDD40A, 61CDD4EE, 61CDD587, 61CDD627, 61CDD6E0, 61CDD768, 61CDD7D8, 61CDD8BF, 61CDDA1A, 61CDDA6A, 61CDDAEF, 61CDDB5F
src/math/tfm_desc.c, xrefs: 61CDCA44, 61CDCA88, 61CDCAD7, 61CDCB15, 61CDCB77, 61CDCB90, 61CDCBA9, 61CDCBC2, 61CDCC27, 61CDCC40, 61CDCC59, 61CDCC72, 61CDCCE1, 61CDCCFA, 61CDCF39, 61CDCF52, 61CDCF8A, 61CDCFA3, 61CDCFE2, 61CDCFFB, 61CDD014, 61CDD04F, 61CDD068, 61CDD081, 61CDD0BF, 61CDD0D8, 61CDD0F1, 61CDD13C, 61CDD155, 61CDD18F, 61CDD1A8, 61CDD1C1, 61CDD207, 61CDD24A, 61CDD263, 61CDD2B4, 61CDD2CD, 61CDD337, 61CDD350, 61CDD369, 61CDD382, 61CDD3B2, 61CDD3EA, 61CDD403, 61CDD44E, 61CDD4E7, 61CDD500, 61CDD567, 61CDD580, 61CDD599, 61CDD607, 61CDD620, 61CDD639, 61CDD6A7, 61CDD6C0, 61CDD6D9, 61CDD6F2, 61CDD72F, 61CDD748, 61CDD761, 61CDD79F, 61CDD7B8, 61CDD7D1, 61CDD847, 61CDD860, 61CDD8B8, 61CDD8D1, 61CDD90A, 61CDD923, 61CDD95A, 61CDD973, 61CDD9AA, 61CDD9C3, 61CDD9FA, 61CDDA13, 61CDDA4A, 61CDDA63, 61CDDA92, 61CDDAE8, 61CDDB01, 61CDDB58, 61CDDB71, 61CDDBA5, 61CDDBD2, 61CDDC02, 61CDDC35, 61CDDCAD, 61CDDCC6
a != NULL, xrefs: 61CDCA4B, 61CDCA8F, 61CDCADE, 61CDCB1C, 61CDCBC9, 61CDCC79, 61CDCCE8, 61CDCF59, 61CDCF91, 61CDCFE9, 61CDD056, 61CDD0C6, 61CDD143, 61CDD196, 61CDD20E, 61CDD251, 61CDD2BB, 61CDD389, 61CDD3B9, 61CDD3F1, 61CDD455, 61CDD507, 61CDD5A0, 61CDD640, 61CDD6F9, 61CDD736, 61CDD7A6, 61CDD867, 61CDD8D8, 61CDD911, 61CDD961, 61CDD9B1, 61CDDA01, 61CDDA51, 61CDDA99, 61CDDB08, 61CDDB78, 61CDDBAC, 61CDDBD9, 61CDDC09, 61CDDC3C, 61CDDCB4, 61CDDCCD
c != NULL, xrefs: 61CDCB97, 61CDCC47, 61CDD002, 61CDD06F, 61CDD0DF, 61CDD1AF, 61CDD2D4, 61CDD357, 61CDD56E, 61CDD60E, 61CDD6C7, 61CDD74F, 61CDD7BF, 61CDD84E, 61CDD92A, 61CDD97A, 61CDD9CA

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID:
String ID: a != NULL$b != NULL$c != NULL$d != NULL$src/math/tfm_desc.c
API String ID: 0-1480740242
Opcode ID: 657c854f8109656302f608bda54c764ce64ad2eb77a8cffc9c6784cd85f3d5ed
Instruction ID: 679c848b80e72bc134cca2b688023156318431221b87f35e7c8ae15312a74bee
Opcode Fuzzy Hash: 657c854f8109656302f608bda54c764ce64ad2eb77a8cffc9c6784cd85f3d5ed
Instruction Fuzzy Hash: 9292DF74F11A46C1FF04EBA4D8803FC66A2EBA5784F94D516CA0E436A4FB7AC256CF11

Function 00007FF69E191450 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fseek, xrefs: 00007FF69E1914C5
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF69E1914F8
malloc, xrefs: 00007FF69E1914FF
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF69E1915BF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF69E1914BE
fread, xrefs: 00007FF69E1915C6
Failed to extract %s: failed to open archive file!, xrefs: 00007FF69E19147F

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 3b29cd868939d2b9268413f6f9bff4204735783e3708139f1dc6f26693374acc
Instruction ID: c159f3db215362ed4f95ac2cfb4c0df4f3e8716bc48664a9ee9cbc609f804acc
Opcode Fuzzy Hash: 3b29cd868939d2b9268413f6f9bff4204735783e3708139f1dc6f26693374acc
Instruction Fuzzy Hash: 16418F72B0864256FB28DB21E4802F96391FF69794F8544B2FD0D87B99DE3CE585C720

Function 00007FF69E1911F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.3.1, xrefs: 00007FF69E191229
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF69E191256
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF69E19129A
malloc, xrefs: 00007FF69E1912A1, 00007FF69E1912D6
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF69E1913FE
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF69E1912CF

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 91f62cc80b3c7fc0dc8cdb411267086f7357e44017bfaadf1bbe0039e9c1b7a1
Instruction ID: 5f24e14aa1e1b619edb470d4464151d3af3cdc3853ec66c01bb5db9ece5c4cc3
Opcode Fuzzy Hash: 91f62cc80b3c7fc0dc8cdb411267086f7357e44017bfaadf1bbe0039e9c1b7a1
Instruction Fuzzy Hash: 9651E122B0868241EA78AB11B4803BA62A1FFA57A4F484175FD4DC7BC5EF3CE585C720

Function 00007FF69E192A70 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF69E192BC5), ref: 00007FF69E192AA1
GetLastError.KERNEL32(?,00007FF69E192BC5), ref: 00007FF69E192AAB

Part of subcall function 00007FF69E192310: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF69E192AC6,?,00007FF69E192BC5), ref: 00007FF69E192360
Part of subcall function 00007FF69E192310: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF69E192AC6,?,00007FF69E192BC5), ref: 00007FF69E19241A

Strings

GetModuleFileNameW, xrefs: 00007FF69E192ABA
\\?\, xrefs: 00007FF69E192B1A
Failed to resolve full path to executable %ls., xrefs: 00007FF69E192AF9
Failed to convert executable path to UTF-8., xrefs: 00007FF69E192B50
Failed to obtain executable path., xrefs: 00007FF69E192AB3

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentErrorFileFormatLastMessageModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 4002088556-2863816727
Opcode ID: aed140f8d8e2637361ba54921802919f4f3b7eb641456186ceb893f60fbbd120
Instruction ID: 573240ce2c2d56d649bc6abb3620cdb0e0dfc17d8a6449be81371fe29533e2b5
Opcode Fuzzy Hash: aed140f8d8e2637361ba54921802919f4f3b7eb641456186ceb893f60fbbd120
Instruction Fuzzy Hash: 52217F21F1864691FB749B21F8853BA2394FFA8794F8001B2F55EC66E9EE2CE505C724

Function 00007FF69E1AC8FC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1ACD29

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b84f99598af9228c6ddbc1f90d02b3ffc499ddb0e7ad6440c3b0aa44b94abea4
Instruction ID: 916c05f46c9f49f610706a61eefaca6229687c7fa24c08b119aedc524c1ab6f5
Opcode Fuzzy Hash: b84f99598af9228c6ddbc1f90d02b3ffc499ddb0e7ad6440c3b0aa44b94abea4
Instruction Fuzzy Hash: 49C1E122A4C78291E7708B1594842BD3B99FFA1BE0F5941B1FA4E83791DF7DE84D8320

Function 00007FF69E1957C0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ucrtbase.dll, xrefs: 00007FF69E19583D
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF69E195827
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF69E1958B6
LoadLibrary, xrefs: 00007FF69E19590E
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF69E195867
Failed to load Python DLL '%ls'., xrefs: 00007FF69E195907

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 257374478d975465f30fecfeee25a4ce820cf249e902578530a6dfb696dcd882
Instruction ID: 45fde336b960ba385dc2fc29373c465883111783f3788f37084f2ff92a899d81
Opcode Fuzzy Hash: 257374478d975465f30fecfeee25a4ce820cf249e902578530a6dfb696dcd882
Instruction Fuzzy Hash: E1419E31E08A8B91FA35DB21F4842E96315FB64384F800172FA5ED769AEF3CE645C360

Function 00007FF69E1A6584 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A65B1
CreateFileW.KERNEL32 ref: 00007FF69E1A65F0
CloseHandle.KERNEL32 ref: 00007FF69E1A6625

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 90a68cc1d689661d78c71e507df06edcdc27397f5c551dab54a651660f08bd46
Instruction ID: 972609c09b9ddc3f1ffd108bbdd87e9af2ca35b4acaad9bf9a05c08f5190d361
Opcode Fuzzy Hash: 90a68cc1d689661d78c71e507df06edcdc27397f5c551dab54a651660f08bd46
Instruction Fuzzy Hash: BA41A162E1878283E7649B2195903797260FFB5764F109374F66C83AD6DF7CE4E48720

Function 00007FF69E19F634 Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E19F678
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E19F76F

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eff41cba983b05e0f9e09f52185aba8178b112ae95ee52c2a1f9a5fdd57fcc68
Instruction ID: 1be00c53b70dbf55f9fb0da38f5a166946e9329541ed1591f933b121ae1f373c
Opcode Fuzzy Hash: eff41cba983b05e0f9e09f52185aba8178b112ae95ee52c2a1f9a5fdd57fcc68
Instruction Fuzzy Hash: F3510821F09B8296FA789E25A48067A6291FF68BB4F144774FD7C877D9CF3CE4418620

Function 00007FF69E19C19C Relevance: 3.1, APIs: 2, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E19C37C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF69E19C390

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF69E19C1C5
__scrt_release_startup_lock.LIBCMT ref: 00007FF69E19C233

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 1236291503-0
Opcode ID: 0062f537d7c131bdaaf4aef5eb59421e6e9ee6bfc8727e8bca4d357a962c4ab6
Instruction ID: dc87d0d1e768ca5f01d2cefcf49844a80befc7fc0432e0402bb41aadc727254f
Opcode Fuzzy Hash: 0062f537d7c131bdaaf4aef5eb59421e6e9ee6bfc8727e8bca4d357a962c4ab6
Instruction Fuzzy Hash: 04311B21E4C20342FA74ABA5A4D13B91291EFA5784F4440B5FA8DCB7D7DE2CB4448671

Function 00007FF69E1AD2B8 Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF69E1AD331
GetFileType.KERNEL32 ref: 00007FF69E1AD347

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 336ff322d096320c7609ad2a1ebfb1af701ecd8db59b0b6a36a9cc413741d25d
Instruction ID: 08485d938d39b7223dce87a1134b404a4e4fa376a58007fb0efd60f92f524b86
Opcode Fuzzy Hash: 336ff322d096320c7609ad2a1ebfb1af701ecd8db59b0b6a36a9cc413741d25d
Instruction Fuzzy Hash: 2531B362A18F4581EB348B1585D027C6650FF65BB4F6903B9EB6E873E0CF38E4A5C310

Function 00007FF69E1ACFD4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF69E1ACFC0,?,?,?,?,?,00007FF69E1AD0C9), ref: 00007FF69E1AD020
GetLastError.KERNEL32(?,?,?,?,?,00007FF69E1ACFC0,?,?,?,?,?,00007FF69E1AD0C9), ref: 00007FF69E1AD02A

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: c8d9032d6f18d1acbd55ff3d5784a6e8b9f1708e95d0104a6ada3112851001ef
Instruction ID: 543f56c799c393360bac886190e69c6aee036643aa23b23035274b0bf5596ae3
Opcode Fuzzy Hash: c8d9032d6f18d1acbd55ff3d5784a6e8b9f1708e95d0104a6ada3112851001ef
Instruction Fuzzy Hash: A611C461A08B4181DA208B25F58417D6361EB54BF4F540771FE7D8B7D9CF7CD0558704

Function 00007FF69E1AB404 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF69E1B3F32,?,?,?,00007FF69E1B3F6F,?,?,00000000,00007FF69E1B4435,?,?,?,00007FF69E1B4367), ref: 00007FF69E1AB41A
GetLastError.KERNEL32(?,?,?,00007FF69E1B3F32,?,?,?,00007FF69E1B3F6F,?,?,00000000,00007FF69E1B4435,?,?,?,00007FF69E1B4367), ref: 00007FF69E1AB424

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 0e9bd81d70d272d571b15e7d509907a6bc8aa23799849ce19584cafaa201c9c5
Instruction ID: 8fadb2bb18ef992cef606f2fe410f866240c901eee22bf2c8df04c646928ebb3
Opcode Fuzzy Hash: 0e9bd81d70d272d571b15e7d509907a6bc8aa23799849ce19584cafaa201c9c5
Instruction Fuzzy Hash: 2EE0EC90F4D64282FF396BF298D91782591DFB8760B4844B4F90ED7366DF2CA8898330

Function 00007FF69E1ABA00 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF69E1AB87D,?,?,00000000,00007FF69E1AB932), ref: 00007FF69E1ABA6E
GetLastError.KERNEL32(?,?,?,00007FF69E1AB87D,?,?,00000000,00007FF69E1AB932), ref: 00007FF69E1ABA78

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 77e2bcd66fe63b7e32e9c420d5456187ea64b38b498190725808e49f9c0985ab
Instruction ID: b009b451a414f05f670a56cba398d0f7075b6ebfa9906927bb8137a733417eb8
Opcode Fuzzy Hash: 77e2bcd66fe63b7e32e9c420d5456187ea64b38b498190725808e49f9c0985ab
Instruction Fuzzy Hash: AE219F61F4868241FE746B25A4D92BD1281DFA47B0F0442B5FA2ECB3D2DE6CE4C94320

Function 00007FF69E1ACD4C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1ACD74

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8b800d1c0215c395d8ee5cb256ced11da9c32d068479accee0e1705fd5882e0a
Instruction ID: 40202bdea925d03a5a4d5c8ad722f144feb6d2391889fb6b8d97333ca5afc71d
Opcode Fuzzy Hash: 8b800d1c0215c395d8ee5cb256ced11da9c32d068479accee0e1705fd5882e0a
Instruction Fuzzy Hash: 3A41A232A4864187EA34DB19E5802B97BA4EF76BA0F140171E78EC76D1CF3CE446C761

Function 00007FF69E1973F0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF69E19749A

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 5faf2e4fea931b2643e5018cf783052bf35d6214a550f297df3baf76f0540905
Instruction ID: e521d1b28f8217583aaf9bd3ec9d33ed1dd49639a0384384c5f1f48a6a6e0f12
Opcode Fuzzy Hash: 5faf2e4fea931b2643e5018cf783052bf35d6214a550f297df3baf76f0540905
Instruction Fuzzy Hash: 3B219421B0869257FA309A16B9847BA9A41FF65BD4F8844B0FD0D87787CF3CE045C210

Function 00007FF69E1AC7DC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1AC862

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ec9d5ae5a000e04b57470e1a65c1a2ebd8d322b6e5cd5ccd1e774105d6e8e50b
Instruction ID: b6deebae02b7d1c8b4be6433517ae9ea7c737764fff8824e7971b85a064cb4cc
Opcode Fuzzy Hash: ec9d5ae5a000e04b57470e1a65c1a2ebd8d322b6e5cd5ccd1e774105d6e8e50b
Instruction Fuzzy Hash: AC318D62E5C61285E7716B69988137C2654FFA0BB4F4202B6FA1D933D2CF7CE4898734

Function 00007FF69E1A6EF4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1A6E59

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
Instruction ID: ef8b096386033fdba4f52dea2b83e231c44652aef57c9d2bb55f21f2f86c9587
Opcode Fuzzy Hash: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
Instruction Fuzzy Hash: 41117222A4C68181EA70DF51D88027EB2A0FFA5BA4F4440B1FB4CD7B96DF7DD8588760

Function 00007FF69E1B7564 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E1B7587

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3767eff042e46cd651120d9163f396646e5b690a05a83219cc7a0fcdceb2a680
Instruction ID: 0236e77d4031e390ea11f4227e8dacb13f99dd211d053198b0353619cac4cacc
Opcode Fuzzy Hash: 3767eff042e46cd651120d9163f396646e5b690a05a83219cc7a0fcdceb2a680
Instruction Fuzzy Hash: 09216572A0868287DB718F18E48037976A0EB94B54F184374F65DC77D9DF3CD4448B10

Function 00007FF69E19F8B4 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E19F908

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
Instruction ID: 7ab0798bc8eb72419f0089d66657c4324d5cf7cf38d1a6cd3f98fd27abd3f83c
Opcode Fuzzy Hash: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
Instruction Fuzzy Hash: 8701F921B08B8650EA24DB52A940079A695FFA9FF0F4C42B1FE6C93BDACF3CD4418710

Function 00007FF69E19C37C Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF69E19C390

Part of subcall function 00007FF69E19CDB8: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF69E19CDC0
Part of subcall function 00007FF69E19CDB8: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF69E19CDC5

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 86517d9d3c6548b93fa1a500576de9512fe9d6a130677b1fbe86fe464c74cea3
Instruction ID: 10902c639a5bc3dc35a85864d6ae186545c6a14fd25b0e0fcfba83f9b6c85eac
Opcode Fuzzy Hash: 86517d9d3c6548b93fa1a500576de9512fe9d6a130677b1fbe86fe464c74cea3
Instruction Fuzzy Hash: CEE0E264D0D24382FEB8A66139C62FD1780CF75304F4000FAF88EE21C39E0E329A11B6

Function 00007FF69E1982E0 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E1988F0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF69E193A24,00000000,00007FF69E191965), ref: 00007FF69E198929

LoadLibraryExW.KERNEL32(?,00007FF69E1958D6,00000000,00007FF69E19272E), ref: 00007FF69E198302

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 2a0be5660c9ee8306d4c5b2947c47421779384b2a6c1156b5f1a19ff2be16db4
Instruction ID: b90dd65912af01b2c9d3d488a828f092e41422c25b54b73ae6f370b320a0ad6e
Opcode Fuzzy Hash: 2a0be5660c9ee8306d4c5b2947c47421779384b2a6c1156b5f1a19ff2be16db4
Instruction Fuzzy Hash: 3ED0C211F3824141FA68A76BBA86679A152EF99BC0F488035FE0C83B4ADD3CC0954B00

Function 00007FF69E1AE664 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF69E1A0208,?,?,?,00007FF69E1A1872,?,?,?,?,?,00007FF69E1A4535), ref: 00007FF69E1AE6A2

Memory Dump Source

Source File: 00000003.00000002.2629743718.00007FF69E191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E190000, based on PE: true

Associated: 00000003.00000002.2629727254.00007FF69E190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629767968.00007FF69E1BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629786537.00007FF69E1D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E214000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2629815093.00007FF69E217000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69e190000_grass.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 3c31cf8336a648e9ecfad8ff9b709a6d49b8502715341f1fffc2c41753e32efa
Instruction ID: 15920640b87c0037a3a3ede04b6f74f25f5e1bf4ee8ff7e196daa82f7e4127d0
Opcode Fuzzy Hash: 3c31cf8336a648e9ecfad8ff9b709a6d49b8502715341f1fffc2c41753e32efa
Instruction Fuzzy Hash: 22F0FE50E9D20245FA756AE259C12791290DFA87B0F484AB0FD3EC73C1EE2CE4988531

Non-executed Functions

Function 61CD5260 Relevance: 63.4, APIs: 30, Strings: 6, Instructions: 406memorystringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 61CD5329
GetProcessHeap.KERNEL32 ref: 61CD5364
HeapAlloc.KERNEL32 ref: 61CD5379
GetAdaptersAddresses.IPHLPAPI ref: 61CD53A9
strlen.MSVCRT ref: 61CD53D7
GetProcessHeap.KERNEL32 ref: 61CD53FB
HeapFree.KERNEL32 ref: 61CD5406
malloc.MSVCRT ref: 61CD5492

Strings

Characteristics, xrefs: 61CD58FE
01234567, xrefs: 61CD52BC
:[sc, xrefs: 61CD52A9
SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}, xrefs: 61CD57BE
89abcdef, xrefs: 61CD52CE
NetCfgInstanceId, xrefs: 61CD58A4

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Heap$Process$AdaptersAddressesAllocComputerFreeNamemallocstrlen
String ID: 01234567$89abcdef$:[sc$Characteristics$NetCfgInstanceId$SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
API String ID: 1478035857-3618987999
Opcode ID: fb5ff797a31862ba17c2551416bcc1e29a5b4184dbec8cc36b1d0a74853ec861
Instruction ID: 3b41a0ebb1b108de64e1684ee1e915b3e7e0c21c6693aeb974435521971488a1
Opcode Fuzzy Hash: fb5ff797a31862ba17c2551416bcc1e29a5b4184dbec8cc36b1d0a74853ec861
Instruction Fuzzy Hash: 81F14972719781C6E760CB66B84079FBBB5F78AB84F848129DF8947B58EB39C005CB11

Function 61CCA260 Relevance: 51.2, APIs: 27, Strings: 2, Instructions: 487COMMON

Download Yara Rule

APIs

PyList_Append.PYTHON310 ref: 61CCA284
PyErr_Occurred.PYTHON310 ref: 61CCA784
PyErr_SetString.PYTHON310 ref: 61CCB61F

Strings

bad marshal data (index list too large), xrefs: 61CCB612
EOF read where object expected, xrefs: 61CCBC1F

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$AppendList_OccurredString
String ID: EOF read where object expected$bad marshal data (index list too large)
API String ID: 2605687773-1134984
Opcode ID: 09f365b29ea617ec1a9918de6a0732721120efa5f7ce55dac81d14968a944cfe
Instruction ID: dd0a400b65332f63f85035b2b51a3e7e91d91eeb98810261c9b409a0f3697be4
Opcode Fuzzy Hash: 09f365b29ea617ec1a9918de6a0732721120efa5f7ce55dac81d14968a944cfe
Instruction Fuzzy Hash: 6D12773220AB90C6EB258BA6E45439E77A5FB85F88F08C415CA9D47B18FF3DC844C742

Function 61CD2B30 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 156memoryfileCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 61CD2B7C
CreateFileA.KERNEL32 ref: 61CD2BB0
GlobalAlloc.KERNEL32 ref: 61CD2BCA
DeviceIoControl.KERNEL32 ref: 61CD2C44
GlobalFree.KERNEL32 ref: 61CD2C5A
_snprintf.MSVCRT ref: 61CD2C97
CreateFileA.KERNEL32 ref: 61CD2CC4
GlobalAlloc.KERNEL32 ref: 61CD2CE5
GlobalAlloc.KERNEL32 ref: 61CD2CF4
DeviceIoControl.KERNEL32 ref: 61CD2D3C
GlobalFree.KERNEL32 ref: 61CD2D55
GlobalFree.KERNEL32 ref: 61CD2D5A
CloseHandle.KERNEL32 ref: 61CD2D64
GlobalFree.KERNEL32 ref: 61CD2D86

Part of subcall function 61CD27E0: GetLastError.KERNEL32 ref: 61CD27E4
Part of subcall function 61CD27E0: FormatMessageA.KERNEL32 ref: 61CD2815
Part of subcall function 61CD27E0: LocalFree.KERNEL32 ref: 61CD2836

Strings

\\.\PhysicalDrive%d, xrefs: 61CD2C8B
Empty serial number, xrefs: 61CD2C60
SCSIDISK, xrefs: 61CD2BF4
/%d:, xrefs: 61CD2B36
\\.\Scsi%d, xrefs: 61CD2B45
../src/platforms/windows/hdinfo.c, xrefs: 61CD2C67

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Global$Free$Alloc$ControlCreateDeviceFile_snprintf$CloseErrorFormatHandleLastLocalMessage
String ID: ../src/platforms/windows/hdinfo.c$/%d:$Empty serial number$SCSIDISK$\\.\PhysicalDrive%d$\\.\Scsi%d
API String ID: 1119308327-3953537554
Opcode ID: 3e4b6cb3af99d3619bf2c18e875b444f9b0e6b19ed9a77fbb3653d60a72b4b1f
Instruction ID: 73ac2af19762e2be4e140ade5e2efc14c882719669a09a10a858ac61324856b2
Opcode Fuzzy Hash: 3e4b6cb3af99d3619bf2c18e875b444f9b0e6b19ed9a77fbb3653d60a72b4b1f
Instruction Fuzzy Hash: DA51DF31300A859AE760DB62FC6478A7B61F789BE8F4882259E5E07BD4DF3DC506C784

Function 61CD3CF0 Relevance: 38.6, APIs: 19, Strings: 3, Instructions: 149networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 61CD3D4F
gethostbyname.WS2_32 ref: 61CD3D60
socket.WS2_32 ref: 61CD3D8D
setsockopt.WS2_32 ref: 61CD3DC5
setsockopt.WS2_32 ref: 61CD3DE8
htons.WS2_32 ref: 61CD3E0B
sendto.WS2_32 ref: 61CD3E89
recvfrom.WS2_32 ref: 61CD3ECE
ntohl.WS2_32 ref: 61CD3EEF
ntohl.WS2_32 ref: 61CD3EF9
closesocket.WS2_32 ref: 61CD3F1E
WSACleanup.WS2_32 ref: 61CD3F24
WSAGetLastError.WS2_32 ref: 61CD3F30
closesocket.WS2_32 ref: 61CD3F3B
WSACleanup.WS2_32 ref: 61CD3F41
SetLastError.KERNEL32 ref: 61CD3F50
WSAGetLastError.WS2_32 ref: 61CD3F70
WSACleanup.WS2_32 ref: 61CD3F78
SetLastError.KERNEL32 ref: 61CD3F87

Strings

http://, xrefs: 61CD3CF5
or,, xrefs: 61CD3CF2
and,, xrefs: 61CD3CF7

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: ErrorLast$Cleanup$closesocketntohlsetsockopt$Startupgethostbynamehtonsrecvfromsendtosocket
String ID: and,$http://$or,
API String ID: 1750001962-2642771825
Opcode ID: d60b143e1d993e80b673ce82980026c53de9bdc10758b609d7e6509d447f81cd
Instruction ID: cff7732c7b2862a89f60e16e8a42003e50a6c67ad3073c416c001683f00e0a6c
Opcode Fuzzy Hash: d60b143e1d993e80b673ce82980026c53de9bdc10758b609d7e6509d447f81cd
Instruction Fuzzy Hash: 45518D7160578496E710DB65F80835EB7A1F788BB4F184329EAA94BBE8EF7DC444CB40

Function 00007FFB0BC21C99 Relevance: 37.1, APIs: 20, Strings: 1, Instructions: 339COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB0BC8A3A8
HMAC_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB0BC8A3B0

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FFB0BC8A24C, 00007FFB0BC8A2B3, 00007FFB0BC8A2F2, 00007FFB0BC8A37B

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: X_free
String ID: ..\s\ssl\t1_lib.c
API String ID: 2268491255-1643863364
Opcode ID: cf7442d83249b4f35ddb88605a11dd2032d676de9761582df6602fa9719c9a54
Instruction ID: 308bc7e4d38a42a69c85b2e8b5f43eec09e9d81562432b2f12911fe1477361d2
Opcode Fuzzy Hash: cf7442d83249b4f35ddb88605a11dd2032d676de9761582df6602fa9719c9a54
Instruction Fuzzy Hash: 27D1C2A2B08642B6FA759A35D444BBD6290EB45B84F449036EE4FC7FA6DF3DE8408700

Function 61CD14B2 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 175COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 61CD14EB

Strings

calling %R should have returned an instance of BaseException, not %R, xrefs: 61CD176A
exceptions must derive from BaseException, xrefs: 61CD14E1
exception causes must derive from BaseException, xrefs: 61CD154A

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_String
String ID: calling %R should have returned an instance of BaseException, not %R$exception causes must derive from BaseException$exceptions must derive from BaseException
API String ID: 1450464846-2865718950
Opcode ID: 592703ca425c36526a6c5bb750356cd5b58cdb8e3781dc57f06ec309ceb843bf
Instruction ID: a586ed58ef7b0e4aa5ea3a25beeceeda3c498c9c6d48128b131da695525a2177
Opcode Fuzzy Hash: 592703ca425c36526a6c5bb750356cd5b58cdb8e3781dc57f06ec309ceb843bf
Instruction Fuzzy Hash: 45611736B45A44D6EB058FAAA95479E37B2A786FD4F4D8021CF4A07B24EF3DC0A5C340

Function 61CC7540 Relevance: 28.5, APIs: 15, Strings: 1, Instructions: 480COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 61CC75B0
PyErr_Format.PYTHON310 ref: 61CC7875
PyErr_Format.PYTHON310 ref: 61CC795D
PyErr_Format.PYTHON310 ref: 61CC7A2D

Strings

%s (%d:%d), xrefs: 61CC7783, 61CC786B, 61CC78E3, 61CC7953, 61CC7A23, 61CC7B7F, 61CC7C2F, 61CC7CEA

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_Format$malloc
String ID: %s (%d:%d)
API String ID: 1817594650-1595188566
Opcode ID: 549cbbdd343e86ee4acbeefccd4c7274211d40d2035c81624c1f006331994ce2
Instruction ID: 444d575d578c14cbaf964b51ce9a3fe210f473fe5ace677c01fe43e54837cce1
Opcode Fuzzy Hash: 549cbbdd343e86ee4acbeefccd4c7274211d40d2035c81624c1f006331994ce2
Instruction Fuzzy Hash: BD02ACB2705B84C1FB158B6AD59036D3BA2FB85F88F48D416CE6D0B754EF29C860E742

Function 61CD2EE0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 171fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 61CD2F05
wsprintfA.USER32 ref: 61CD2F17
CreateFileA.KERNEL32 ref: 61CD2F44
memset.MSVCRT ref: 61CD2F83
DeviceIoControl.KERNEL32 ref: 61CD2FB9
CloseHandle.KERNEL32 ref: 61CD2FC6
isxdigit.MSVCRT ref: 61CD3043
isxdigit.MSVCRT ref: 61CD3070
isprint.MSVCRT ref: 61CD309B
memcpy.MSVCRT ref: 61CD312B
CloseHandle.KERNEL32 ref: 61CD3133

Strings

\\.\PhysicalDrive%d, xrefs: 61CD2F10
/%d:, xrefs: 61CD2EE6

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: CloseHandleisxdigitmemset$ControlCreateDeviceFileisprintmemcpywsprintf
String ID: /%d:$\\.\PhysicalDrive%d
API String ID: 2355516209-72258043
Opcode ID: 233270e7e1e41bc5ccc68ddfde30d2476ab27d374bc2da1ff46a8b8117bbecc6
Instruction ID: e9aa96cfdbf08bd61fafa917dabc6faef26b2ba35a5f67aa9ffafea22b446250
Opcode Fuzzy Hash: 233270e7e1e41bc5ccc68ddfde30d2476ab27d374bc2da1ff46a8b8117bbecc6
Instruction Fuzzy Hash: A75124B2608691C1E711CB76A89435FBBA2B7C67D8F48C115EF9947B99EB7DC008CB40

Function 00007FFB0BA7F400 Relevance: 24.5, APIs: 16, Instructions: 493COMMON

Download Yara Rule

APIs

log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA7F4E7
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA7F543
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA7F592
memset.VCRUNTIME140 ref: 00007FFB0BA7F5E8
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA7F696
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA7F6F2
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA7F747
memmove.VCRUNTIME140 ref: 00007FFB0BA7F7A7
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA7F8C7
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA7F923
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA7F972
memset.VCRUNTIME140 ref: 00007FFB0BA7FA74
memmove.VCRUNTIME140 ref: 00007FFB0BA7FB08
memset.VCRUNTIME140 ref: 00007FFB0BA7FB52
memmove.VCRUNTIME140 ref: 00007FFB0BA7FBA4
memset.VCRUNTIME140 ref: 00007FFB0BA7FBE6

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: log2$memset$memmove
String ID:
API String ID: 1685334282-0
Opcode ID: 1edd070486128180aaf4a9b6a699bce50f64173daa6afe7625103dfdb958fdbf
Instruction ID: 8391ede60f96dc3eb57aa9e724efcb6eed6e33914926917d7fc32415c10ff8b8
Opcode Fuzzy Hash: 1edd070486128180aaf4a9b6a699bce50f64173daa6afe7625103dfdb958fdbf
Instruction Fuzzy Hash: B022D2B2A58F858ADA168B34D9107BAB365FF597C4F15C332DA8B67760DF3DE1428200

Function 00007FFB0BA7FEB0 Relevance: 24.5, APIs: 16, Instructions: 493COMMON

Download Yara Rule

APIs

log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA7FF97
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA7FFF3
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA80042
memset.VCRUNTIME140 ref: 00007FFB0BA80098
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA80146
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA801A2
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA801F7
memmove.VCRUNTIME140 ref: 00007FFB0BA80257
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA80377
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA803D3
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA80422
memset.VCRUNTIME140 ref: 00007FFB0BA80524
memmove.VCRUNTIME140 ref: 00007FFB0BA805B8
memset.VCRUNTIME140 ref: 00007FFB0BA80602
memmove.VCRUNTIME140 ref: 00007FFB0BA80654
memset.VCRUNTIME140 ref: 00007FFB0BA80696

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: log2$memset$memmove
String ID:
API String ID: 1685334282-0
Opcode ID: d0ebc9dcb9b4dfbefd1d47e463b8048210ff77d408c872b9899fd701b123924b
Instruction ID: 5e03d137c7792b049fb68240e001d30e8fdf25fd2a077e1feae6b111a3a187d4
Opcode Fuzzy Hash: d0ebc9dcb9b4dfbefd1d47e463b8048210ff77d408c872b9899fd701b123924b
Instruction Fuzzy Hash: 5722AF72A04F858ADA2A9B34D1507FAA365FF597C4F15C332DB8F66B60DF38E0468200

Function 61CE5040 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 110encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 61CE5096
CryptAcquireContextA.ADVAPI32 ref: 61CE50B6
CryptGenRandom.ADVAPI32 ref: 61CE50C7
CryptReleaseContext.ADVAPI32 ref: 61CE50DD
clock.MSVCRT ref: 61CE5120
clock.MSVCRT ref: 61CE5133
clock.MSVCRT ref: 61CE513C
clock.MSVCRT ref: 61CE5153

Strings

Microsoft Base Cryptographic Provider v1.0, xrefs: 61CE5085, 61CE50AC
(, xrefs: 61CE509E
out != NULL, xrefs: 61CE51A7
src/prngs/rng_get_bytes.c, xrefs: 61CE51A0

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Cryptclock$Context$Acquire$RandomRelease
String ID: ($Microsoft Base Cryptographic Provider v1.0$out != NULL$src/prngs/rng_get_bytes.c
API String ID: 2525729555-3762154145
Opcode ID: 5007ee38210087e13fb3603f037d087b27600e9943a9c9daa80f0b48f3474df8
Instruction ID: f13955dbbc173a840599a565ffc498db52cde7b5a37abde4f5493fe0f5498970
Opcode Fuzzy Hash: 5007ee38210087e13fb3603f037d087b27600e9943a9c9daa80f0b48f3474df8
Instruction Fuzzy Hash: F031C676718740D2E711CBAAA84835EBBB2B7897C4F549025DE4983764FF7EC446C390

Function 00007FFB0BC21B81 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB0BC8CE23
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB0BC8CE3C
BN_free.LIBCRYPTO-1_1 ref: 00007FFB0BC8CE48
BN_free.LIBCRYPTO-1_1 ref: 00007FFB0BC8CE54
BN_free.LIBCRYPTO-1_1 ref: 00007FFB0BC8CE60
BN_free.LIBCRYPTO-1_1 ref: 00007FFB0BC8CE6C
BN_free.LIBCRYPTO-1_1 ref: 00007FFB0BC8CE78
BN_free.LIBCRYPTO-1_1 ref: 00007FFB0BC8CE84
BN_free.LIBCRYPTO-1_1 ref: 00007FFB0BC8CE90
BN_free.LIBCRYPTO-1_1 ref: 00007FFB0BC8CE9C

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FFB0BC8CE16, 00007FFB0BC8CE2F

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: N_free$O_free
String ID: ..\s\ssl\tls_srp.c
API String ID: 3506937590-1778748169
Opcode ID: 27b7e6b1a2380756cfa26162b9f83e50214ddb54b7d7688408707897998f30c0
Instruction ID: 8148c1cdf815bda1ed6ba3a65a4943e5674b104ffa88db820839b2d4c8d40e71
Opcode Fuzzy Hash: 27b7e6b1a2380756cfa26162b9f83e50214ddb54b7d7688408707897998f30c0
Instruction Fuzzy Hash: F3216252D18683A1E750EF75C4507FC1350FF94B48F08D235ED4E8B6A6DF58A5D18BA0

Function 00007FFB0BA76FC0 Relevance: 18.4, APIs: 12, Instructions: 450COMMON

Download Yara Rule

APIs

log2.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FFB0BA7BDCA), ref: 00007FFB0BA770F4
log2.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FFB0BA7BDCA), ref: 00007FFB0BA77160
log2.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FFB0BA7BDCA), ref: 00007FFB0BA771B9
log2.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FFB0BA7BDCA), ref: 00007FFB0BA77224
log2.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FFB0BA7BDCA), ref: 00007FFB0BA7728C
log2.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FFB0BA7BDCA), ref: 00007FFB0BA772E2
log2.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FFB0BA7BDCA), ref: 00007FFB0BA77354
log2.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FFB0BA7BDCA), ref: 00007FFB0BA773BE
log2.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FFB0BA7BDCA), ref: 00007FFB0BA77415
log2.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FFB0BA7BDCA), ref: 00007FFB0BA77494
log2.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FFB0BA7BDCA), ref: 00007FFB0BA774FC
log2.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FFB0BA7BDCA), ref: 00007FFB0BA77552

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: log2
String ID:
API String ID: 4048861018-0
Opcode ID: 1ba6ff57bb3133cb648baf168f3054a4e5542cce55b8d95569e4c63513385875
Instruction ID: 4f8b81800fc3b4a49fdc44c7c78551ebaf0aa446bf14daf98e499b6da8fd2ebe
Opcode Fuzzy Hash: 1ba6ff57bb3133cb648baf168f3054a4e5542cce55b8d95569e4c63513385875
Instruction Fuzzy Hash: 8A02F7B2F9CE014AE607CB74C501BBAA366AF153D4F16C332E91FB6664DF7C64928640

Function 00007FFB0BC21C08 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB0BC388C9
memset.VCRUNTIME140 ref: 00007FFB0BC388F7
memcpy.VCRUNTIME140 ref: 00007FFB0BC38901
memcpy.VCRUNTIME140 ref: 00007FFB0BC38933
CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB0BC38956
CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB0BC389BD
CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB0BC389CA
CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB0BC38A38
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FFB0BC38A3F

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFB0BC388A5, 00007FFB0BC3893F, 00007FFB0BC389A6, 00007FFB0BC38A31

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: O_clear_free$memcpy$L_cleanseO_mallocmemset
String ID: ..\s\ssl\s3_lib.c
API String ID: 2649524955-4238427508
Opcode ID: c8176c414889550db18000435abb5a1deba6356550613b413f080dcc09cb8534
Instruction ID: 9908c58d46c1c38e5fe5aa43c62263e3d4b0390a5465d131d9aecba359e4fa0e
Opcode Fuzzy Hash: c8176c414889550db18000435abb5a1deba6356550613b413f080dcc09cb8534
Instruction Fuzzy Hash: F15170B2709782A6EA649F26E444AAE7760FB44FC4F548131EE8E87B65CF3CE155C700

Function 00007FFB0BC71BE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1(?,00007FFB0BC70F48), ref: 00007FFB0BC71C1B
ERR_put_error.LIBCRYPTO-1_1(?,00007FFB0BC70F48), ref: 00007FFB0BC71C43
CRYPTO_malloc.LIBCRYPTO-1_1(?,00007FFB0BC70F48), ref: 00007FFB0BC71C64
ERR_put_error.LIBCRYPTO-1_1(?,00007FFB0BC70F48), ref: 00007FFB0BC71C8C
CRYPTO_free.LIBCRYPTO-1_1(?,00007FFB0BC70F48), ref: 00007FFB0BC71C9F

Strings

R, xrefs: 00007FFB0BC71CDA
..\s\ssl\statem\statem_dtls.c, xrefs: 00007FFB0BC71C0D, 00007FFB0BC71C28, 00007FFB0BC71C5A, 00007FFB0BC71C71, 00007FFB0BC71C95, 00007FFB0BC71CBF, 00007FFB0BC71CD3, 00007FFB0BC71CFA

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: O_mallocR_put_error$O_free
String ID: ..\s\ssl\statem\statem_dtls.c$R
API String ID: 1091011155-469809446
Opcode ID: 59325991ab593bf80ca705787716aaa9c8a4ca3c0951ce7c0107c3326519f8fd
Instruction ID: 9e8a6958fbacfc2ab98cb5aab824a1b2a051b238904f0cd82b29868af3f27ffa
Opcode Fuzzy Hash: 59325991ab593bf80ca705787716aaa9c8a4ca3c0951ce7c0107c3326519f8fd
Instruction Fuzzy Hash: 5C313E72A18746B6E770DF21E400AA967A1FB44784F448035EA4F97FA5EF3DE909DB00

Function 61D40410 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 61D40424
RtlLookupFunctionEntry.KERNEL32 ref: 61D4043B
RtlVirtualUnwind.KERNEL32 ref: 61D4047D
SetUnhandledExceptionFilter.KERNEL32 ref: 61D404C1
UnhandledExceptionFilter.KERNEL32 ref: 61D404CE
GetCurrentProcess.KERNEL32 ref: 61D404D4
TerminateProcess.KERNEL32 ref: 61D404E2
abort.MSVCRT ref: 61D404E8

Strings

Jzkx;, xrefs: 61D404AB

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
String ID: Jzkx;
API String ID: 4278921479-166890614
Opcode ID: 0b663a1d556b8c52057113c1d16885c0c6fcd30d41580010eda9e63133874608
Instruction ID: 867b5c6c5b71ee85a50a67044eea30ce3677bceea3a3fbc75eca1d2c6942bcc8
Opcode Fuzzy Hash: 0b663a1d556b8c52057113c1d16885c0c6fcd30d41580010eda9e63133874608
Instruction Fuzzy Hash: 9A21D076211B04A5EB00CF65F8843DA37B6BB0DB94F484126EA5E5B724EF3AC165C780

Function 00007FFB0BA77660 Relevance: 10.8, APIs: 7, Instructions: 267COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFB0BA776CB
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA777DD
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA77840
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA77894
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA77913
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA77974
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA779C7

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: log2$memset
String ID:
API String ID: 3759962277-0
Opcode ID: 0a616068c14d0cc25b55d560957346411adc6e39c4d7ed9e6f163420d756dbf1
Instruction ID: 8b0f3843804b07cbc0db326988bdbeeb40c1c7f9763096c29d619dd32142ea98
Opcode Fuzzy Hash: 0a616068c14d0cc25b55d560957346411adc6e39c4d7ed9e6f163420d756dbf1
Instruction Fuzzy Hash: 9FB137A2F5CE5589EA078734C500BBAA25AAF557D5F16C332E94F67B64DF3CA4828200

Function 00007FFB0BA66F40 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB0BA66FE9
memset.VCRUNTIME140 ref: 00007FFB0BA67050

Strings

, xrefs: 00007FFB0BA671A8

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: exitmemset
String ID:
API String ID: 2099101326-2920267241
Opcode ID: 1e7f654b3abe498549c85a9da2b5d6289def08c45c33cc899f933d97bd9daf92
Instruction ID: 33819fe12acf62905570d1c1a4c66598dc401f24bd092cc329e84e9ce95b23de
Opcode Fuzzy Hash: 1e7f654b3abe498549c85a9da2b5d6289def08c45c33cc899f933d97bd9daf92
Instruction Fuzzy Hash: 1FC13CB2618BC586D660CB25F8407AAB7A4F789B84F549126EFCD43B69DF3CC155CB00

Function 00007FFB0BC80B50 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

APIs

EVP_PKEY_get0_RSA.LIBCRYPTO-1_1(?,?,?,?,00007FFB0BC8237A), ref: 00007FFB0BC80B8A

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFB0BC80BA2, 00007FFB0BC80C82, 00007FFB0BC80CB3

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: Y_get0_
String ID: ..\s\ssl\statem\statem_srvr.c
API String ID: 2256133966-348624464
Opcode ID: 90bc40450ee750355726227821781c05988d76dd35d3ebf803da9011ac1e5896
Instruction ID: af5a8cff0fee4b5101ebb1e31137b533c0be1e41320027bf62577ea3a07420ca
Opcode Fuzzy Hash: 90bc40450ee750355726227821781c05988d76dd35d3ebf803da9011ac1e5896
Instruction Fuzzy Hash: C3A1F2B2718691A6E7308B35D410BBE7BA1FB85784F448134EA8AC7B96DF3DD549CB00

Function 00007FFB0BA5F5D0 Relevance: 9.2, APIs: 6, Instructions: 245COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFB0BA5F625
memset.VCRUNTIME140 ref: 00007FFB0BA5F676
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA5F6CA
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA5F771
memset.VCRUNTIME140 ref: 00007FFB0BA5F7BD
memset.VCRUNTIME140 ref: 00007FFB0BA5F7E3

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: memset$log2
String ID:
API String ID: 3851851888-0
Opcode ID: 64f3392d5d0c07b22c2d9f88ec33949d3f89d5b72106fb347fe14f0603d3ecf4
Instruction ID: 9aae91b4f58c706e2aace12baadc1b653f3229ff46847c79decfddd4420bebd7
Opcode Fuzzy Hash: 64f3392d5d0c07b22c2d9f88ec33949d3f89d5b72106fb347fe14f0603d3ecf4
Instruction Fuzzy Hash: AEA1E662A18FC589D6128B75E400BAAA765FF96784F048232DA8F67765DF3DE142CB00

Function 00007FFB0BA60EB0 Relevance: 9.2, APIs: 6, Instructions: 239COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFB0BA60F05
memset.VCRUNTIME140 ref: 00007FFB0BA60F56
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA60FAA
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA61051
memset.VCRUNTIME140 ref: 00007FFB0BA6109D
memset.VCRUNTIME140 ref: 00007FFB0BA610C3

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: memset$log2
String ID:
API String ID: 3851851888-0
Opcode ID: 9cac2ff7569d438a0fc14b80d39a9464d9c8e47c46ba66bb0d0afa152fd710d5
Instruction ID: 4b6bb6852db8855987972f19028408720310040416e0ccd541ba08d9346c7ab7
Opcode Fuzzy Hash: 9cac2ff7569d438a0fc14b80d39a9464d9c8e47c46ba66bb0d0afa152fd710d5
Instruction Fuzzy Hash: A7A10AA2A18BC589DA128B75E400BAAA765FF557C4F04E236DA4F67665CF3CE046C700

Function 00007FFB0BA62700 Relevance: 9.2, APIs: 6, Instructions: 239COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFB0BA62755
memset.VCRUNTIME140 ref: 00007FFB0BA627A6
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA627FA
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA628A1
memset.VCRUNTIME140 ref: 00007FFB0BA628ED
memset.VCRUNTIME140 ref: 00007FFB0BA62913

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: memset$log2
String ID:
API String ID: 3851851888-0
Opcode ID: 630956aaa5f078cabb962465cabea9a2edb90d42bcb192cf7cf7d8a395303877
Instruction ID: a0cade8212b93f0da585549ae6cdc1a04a3608bfbc190302fd3a773ed005e396
Opcode Fuzzy Hash: 630956aaa5f078cabb962465cabea9a2edb90d42bcb192cf7cf7d8a395303877
Instruction Fuzzy Hash: F6A1F9A2A18BC589D6168B75E400BEAB755FF96784F04D236DA4F67665CF3CE042C700

Function 00007FFB0BC26BA0 Relevance: 9.1, APIs: 6, Instructions: 92COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB0BC26BD9
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB0BC26C1F
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB0BC26C6B
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB0BC26C96
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB0BC26CC7
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB0BC26CFF

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: 8528c44f1b554a9d6ffd954fb256f48237370f9ba8ae768e45797e0a09dfd22b
Instruction ID: 46d49a1107a145123de1b85a086fa453a3addbd14416d774d8d5e9bf12353df4
Opcode Fuzzy Hash: 8528c44f1b554a9d6ffd954fb256f48237370f9ba8ae768e45797e0a09dfd22b
Instruction Fuzzy Hash: 9F31677371828556DBA8DB79D591FFD3291EB88B80F058434DE0E8BF61DF68E4509701

Function 00007FFB0BC4CC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB0BC4CC46
CRYPTO_realloc.LIBCRYPTO-1_1 ref: 00007FFB0BC4CC95
CRYPTO_realloc.LIBCRYPTO-1_1 ref: 00007FFB0BC4CCC3
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB0BC4CCED

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB0BC4CC2B, 00007FFB0BC4CC8E, 00007FFB0BC4CCB0, 00007FFB0BC4CCDD

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: O_reallocR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1389097454-1080266419
Opcode ID: 457e9c35d0488873b3766b322ed8f6e4aee3b6ae0d3e168fe7206a5c874f4f61
Instruction ID: 899faeebb9c73778152958fc6b28d1152d583cd5c535d5cc95a565e1a31b7cd6
Opcode Fuzzy Hash: 457e9c35d0488873b3766b322ed8f6e4aee3b6ae0d3e168fe7206a5c874f4f61
Instruction Fuzzy Hash: 1231B6B2619746A6EB258F35E400BAA7790FB44B98F448531EE8E87BB4DF3CE541D700

Function 00007FFB0BA5E090 Relevance: 7.9, APIs: 5, Instructions: 359COMMON

Download Yara Rule

APIs

log2.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100,?), ref: 00007FFB0BA5E341
log2.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100,?), ref: 00007FFB0BA5E3C5
log2.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100,?), ref: 00007FFB0BA5E551
log2.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100,?), ref: 00007FFB0BA5E5B0
log2.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100,?), ref: 00007FFB0BA5E600

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: log2
String ID:
API String ID: 4048861018-0
Opcode ID: 4ce18a24f6bbc4e66d1632d99029d87051404aa3dbe531e978db1d1c2478575e
Instruction ID: 86c5038ff3cac6d036bd881b56583cd846931508486e4c671ac01731791971f6
Opcode Fuzzy Hash: 4ce18a24f6bbc4e66d1632d99029d87051404aa3dbe531e978db1d1c2478575e
Instruction Fuzzy Hash: EEE1D9B1F18E858AEA178734D101BB9B365EF997D4F14C336D54F62764EF39A2828A00

Function 00007FFB0BC41C60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB0BC41D0C
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FFB0BC41D21

Part of subcall function 00007FFB0BC22095: ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FFB0BC52F33
Part of subcall function 00007FFB0BC22095: BIO_s_file.LIBCRYPTO-1_1 ref: 00007FFB0BC52F5B
Part of subcall function 00007FFB0BC22095: BIO_new.LIBCRYPTO-1_1 ref: 00007FFB0BC52F63
Part of subcall function 00007FFB0BC22095: ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB0BC52F8B
Part of subcall function 00007FFB0BC22095: X509_free.LIBCRYPTO-1_1 ref: 00007FFB0BC53100
Part of subcall function 00007FFB0BC22095: BIO_free.LIBCRYPTO-1_1 ref: 00007FFB0BC53108

Strings

..\s\ssl\ssl_conf.c, xrefs: 00007FFB0BC41D05, 00007FFB0BC41D17
gfffffff, xrefs: 00007FFB0BC41CDD

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: O_free$O_newO_s_fileO_strdupR_clear_errorR_put_errorX509_free
String ID: ..\s\ssl\ssl_conf.c$gfffffff
API String ID: 3738848979-4123734156
Opcode ID: 412dd9fff653bb11fe9b08e63c45f7e87bcc8f87c1d266025790deaff3528731
Instruction ID: e6bd35d5bd892fce2ea9abd4a30f9afacfd7013313bc621ee6bcbbf9d3c77a28
Opcode Fuzzy Hash: 412dd9fff653bb11fe9b08e63c45f7e87bcc8f87c1d266025790deaff3528731
Instruction Fuzzy Hash: E02190B2B15B4595EE64DF2AE44076927A0EB88FC0F188035EE4ED7B65DF28E5418340

Function 61CD27E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 61CD27E4
FormatMessageA.KERNEL32 ref: 61CD2815
LocalFree.KERNEL32 ref: 61CD2836

Strings

../src/platforms/windows/hdinfo.c, xrefs: 61CD2820

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: ../src/platforms/windows/hdinfo.c
API String ID: 1365068426-2451707101
Opcode ID: e7f08c15d8cbf063678237260762927268d9f9e79990ee96d584c2113e730dff
Instruction ID: 1a7db6b2fbf6c304026f98ba7d31e9012e9d651de69dd5a5a8494e7446dfba3a
Opcode Fuzzy Hash: e7f08c15d8cbf063678237260762927268d9f9e79990ee96d584c2113e730dff
Instruction Fuzzy Hash: 8BF03931314A41D2E7109B51E89438E7B72F7C9B89F544129DA8E43B68EF3EC15ACB80

Function 00007FFB0BA77AA0 Relevance: 6.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFB0BA77B81
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA77C3A
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA77C97
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA77CE6

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: log2$memset
String ID:
API String ID: 3759962277-0
Opcode ID: 7cb003af3fe56c2fa4ef3186a0cf0e2ba4dccb740a689c643034ce6301a7a5df
Instruction ID: ae8ebd2aaa91c8a3b7aeace64bbe09b1f12ec76bc15b491df2643550ca6dfabb
Opcode Fuzzy Hash: 7cb003af3fe56c2fa4ef3186a0cf0e2ba4dccb740a689c643034ce6301a7a5df
Instruction Fuzzy Hash: 34619EA2F4CE8549E9278334D901BFAA255EF997C4F15C332DA4FB6B64EF2CB4428500

Function 00007FFB0BA70600 Relevance: 6.2, APIs: 4, Instructions: 160COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFB0BA706C2
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA7073D
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA7079A
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA707F1

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: log2$memset
String ID:
API String ID: 3759962277-0
Opcode ID: c462b1730b2cc9fe60fe652cd5c109c1ac0dba0022eaa0918e110071f0e1ffe6
Instruction ID: cd72851f3fcb881625f33c8a5cebbf87e843af0e2fdfe2282b3331d7441dfc70
Opcode Fuzzy Hash: c462b1730b2cc9fe60fe652cd5c109c1ac0dba0022eaa0918e110071f0e1ffe6
Instruction Fuzzy Hash: 195158A1F9CE4549E917C738C511BBAE21AAFA57D4E15C332E94FB2A60DF3DB0838500

Function 00007FFB0BC6DBE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB0BC6DCDD
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB0BC6DD24

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB0BC6DBFA, 00007FFB0BC6DCD0

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 2581946324-1507966698
Opcode ID: 3141108de7234470c54ad9726d6a351f58ca2817067a753fbd53601a5b991db5
Instruction ID: e9231995453f4eec25d3e6164d4daf7cacf2db4cedb5ffdf66c02778ed162a03
Opcode Fuzzy Hash: 3141108de7234470c54ad9726d6a351f58ca2817067a753fbd53601a5b991db5
Instruction Fuzzy Hash: 173185B2A1C6C155E7608B65E450BAAB790FB857D4F048134EACE97FA5DF7CD1908B00

Function 00007FFB0BC21BCC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FFB0BC42627
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB0BC42655

Strings

..\s\ssl\ssl_conf.c, xrefs: 00007FFB0BC4261D, 00007FFB0BC42648

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: O_freeO_strdup
String ID: ..\s\ssl\ssl_conf.c
API String ID: 2148955802-1527728938
Opcode ID: 475cc2bbd808bb89294e481fac7ef19622eb317756c7a8bcef4a154acb9ddcad
Instruction ID: b5df7c47c81446d6763ba361eef92890560852d2b874bb7f9a19d28fc9a14054
Opcode Fuzzy Hash: 475cc2bbd808bb89294e481fac7ef19622eb317756c7a8bcef4a154acb9ddcad
Instruction Fuzzy Hash: F311A3A1E19782A1FA758B65E141B686690AB447C4F488034FB8F8BF69DF2CE5908704

Function 00007FFB0BC21C8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB0BC54075
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FFB0BC54097

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFB0BC54061, 00007FFB0BC5408A

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ..\s\ssl\ssl_sess.c
API String ID: 3962629258-2868363209
Opcode ID: 128b89c1ee173af92281a39cd2c5b6dac4acaa1dced732c40567bbf9dcc6855f
Instruction ID: e42eb85a4d993cd5d14550ff525079cc800c570da9afd77168dab6d7a94f9603
Opcode Fuzzy Hash: 128b89c1ee173af92281a39cd2c5b6dac4acaa1dced732c40567bbf9dcc6855f
Instruction Fuzzy Hash: EE11E971B19B81A1E7A58B25F480A58B290EF44BC4F184130ED4E8BF6DDF2CD6D18310

Function 00007FFB0BC57C90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB0BC57CC1
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB0BC57D04

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FFB0BC57CA6, 00007FFB0BC57CF0

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions.c
API String ID: 2581946324-1165805907
Opcode ID: d0c9e50c82c640360316dc5f7b4349516dd4649572525e89d47dc48f9c0d474d
Instruction ID: 21f4b4b55a1e8b9e278053e0be86e1aaec224c6663cf6bd8a115172aa4de7bef
Opcode Fuzzy Hash: d0c9e50c82c640360316dc5f7b4349516dd4649572525e89d47dc48f9c0d474d
Instruction Fuzzy Hash: 0F017172B04B81A5D751CF2AD4807A873A8EB85FC4F188036EE4D8BBB5CF75C5858300

Function 00007FFB0BC67C50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB0BC67C79
CRYPTO_strndup.LIBCRYPTO-1_1 ref: 00007FFB0BC67C92

Strings

D:\a\1\s\ssl\packet_local.h, xrefs: 00007FFB0BC67C6F, 00007FFB0BC67C82

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: O_freeO_strndup
String ID: D:\a\1\s\ssl\packet_local.h
API String ID: 2641571835-373350680
Opcode ID: 4da2ad94cbdcd89c89d071f6cd9ad530b8028bab093b2de902632526adc10d13
Instruction ID: b3dbbf782c3c668e1b36ab981f4c7f78f49ee99f5a64cf23514b47ba5cbb8c24
Opcode Fuzzy Hash: 4da2ad94cbdcd89c89d071f6cd9ad530b8028bab093b2de902632526adc10d13
Instruction Fuzzy Hash: 5BF0A771B04E46A1EB109B65E4419AC6361DB4CBC8F04C035FE0EC7BA5CE3CD5618300

Function 00007FFB0BC57BF0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB0BC57C31

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FFB0BC57C24

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions.c
API String ID: 2581946324-1165805907
Opcode ID: c154ed0c23af4f4a2ab3c94700327fb069ddd3c2668019da7fb3bde8ec48adac
Instruction ID: 214bedc8a111cbbf7bd2ca1263fe1ed983ca1cfbe61b177609e8f1fd6a34cb7c
Opcode Fuzzy Hash: c154ed0c23af4f4a2ab3c94700327fb069ddd3c2668019da7fb3bde8ec48adac
Instruction Fuzzy Hash: 76F02BF2B026419AF7A09B38D445B942290DB44718F1C0230DA1DCB7E1EF3B84E2C710

Function 61CC1D00 Relevance: 2.5, Strings: 2, Instructions: 24COMMON

Download Yara Rule

Strings

NtSetInformationThread, xrefs: 61CC1D1E
ntdll.dll, xrefs: 61CC1D04

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID:
String ID: NtSetInformationThread$ntdll.dll
API String ID: 0-3743287242
Opcode ID: 44ff21734f2ff3973436570afbf4a4f696a535759bc606b7929e125bc87f373a
Instruction ID: 7dd1e9d1e115df134ad7c334bd20a3f6430adc344937807bc8e558ee08b7fcc7
Opcode Fuzzy Hash: 44ff21734f2ff3973436570afbf4a4f696a535759bc606b7929e125bc87f373a
Instruction Fuzzy Hash: EEF01C31314A4895EB60DB56FC8038927A1F38CB84F480225D98C83774DF3EC651CB40

Function 61D63550 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1776b9609a1a5930733c7ec6af33de0207b8f0bef9b3e78ca7bf489d44b57c
Instruction ID: 4b0fe27ade4d74af5ae42047f4b5d46a224c168b2ecabc83e0e81d94ce0455ab
Opcode Fuzzy Hash: df1776b9609a1a5930733c7ec6af33de0207b8f0bef9b3e78ca7bf489d44b57c
Instruction Fuzzy Hash: 09D05EE3A5EFC16AE3035FB4AC29B5A2F2443E3541F8BC19AD29557163A95C54068321

Function 61D41D19 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ef87f82fbfebd99247f37b5908a0d7ce27eb74ca9d59a6c86a4a0b91d50cb10
Instruction ID: 76618c5bb4a55d08d86c6a0eb53039d544587aa8fdff3f88cff7f6caa375ec72
Opcode Fuzzy Hash: 5ef87f82fbfebd99247f37b5908a0d7ce27eb74ca9d59a6c86a4a0b91d50cb10
Instruction Fuzzy Hash: 8EA00232A5AC14E1D2005B00E8017E05179D317700F093121481C51011856D80544184

Function 61CD3560 Relevance: 75.7, APIs: 27, Strings: 16, Instructions: 436filestringCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61CD359E

Part of subcall function 61CD31B0: strlen.MSVCRT ref: 61CD31D3

fprintf.MSVCRT ref: 61CD35D7

Part of subcall function 61CD33D0: strlen.MSVCRT ref: 61CD33EA

fputc.MSVCRT ref: 61CD3609

Part of subcall function 61CD2850: GetProcessHeap.KERNEL32 ref: 61CD2873
Part of subcall function 61CD2850: HeapAlloc.KERNEL32 ref: 61CD2887
Part of subcall function 61CD2850: GetAdaptersAddresses.IPHLPAPI ref: 61CD28AC
Part of subcall function 61CD2850: GetProcessHeap.KERNEL32 ref: 61CD291F
Part of subcall function 61CD2850: HeapFree.KERNEL32 ref: 61CD2929

fprintf.MSVCRT ref: 61CD3638

Part of subcall function 61CD2660: GetProcessHeap.KERNEL32 ref: 61CD2681
Part of subcall function 61CD2660: HeapAlloc.KERNEL32 ref: 61CD2696
Part of subcall function 61CD2660: memcpy.MSVCRT ref: 61CD270C
Part of subcall function 61CD2660: GetProcessHeap.KERNEL32 ref: 61CD272A
Part of subcall function 61CD2660: HeapFree.KERNEL32 ref: 61CD2735

fputc.MSVCRT ref: 61CD366B

Part of subcall function 61CD29E0: GetProcessHeap.KERNEL32 ref: 61CD2A03
Part of subcall function 61CD29E0: HeapAlloc.KERNEL32 ref: 61CD2A17
Part of subcall function 61CD29E0: GetAdaptersAddresses.IPHLPAPI ref: 61CD2A3F
Part of subcall function 61CD29E0: inet_ntoa.WS2_32 ref: 61CD2A77
Part of subcall function 61CD29E0: GetProcessHeap.KERNEL32 ref: 61CD2A92
Part of subcall function 61CD29E0: HeapFree.KERNEL32 ref: 61CD2A9C

fprintf.MSVCRT ref: 61CD369A
fputc.MSVCRT ref: 61CD36AE

Part of subcall function 61CD2DE0: GetProcessHeap.KERNEL32 ref: 61CD2DFB
Part of subcall function 61CD2DE0: HeapAlloc.KERNEL32 ref: 61CD2E0F
Part of subcall function 61CD2DE0: GetNetworkParams.IPHLPAPI ref: 61CD2E47
Part of subcall function 61CD2DE0: GetProcessHeap.KERNEL32 ref: 61CD2E69
Part of subcall function 61CD2DE0: HeapFree.KERNEL32 ref: 61CD2E73

fprintf.MSVCRT ref: 61CD36DD
fwrite.MSVCRT ref: 61CD36FE
strchr.MSVCRT ref: 61CD372B
fwrite.MSVCRT ref: 61CD3763
fprintf.MSVCRT ref: 61CD378B
strchr.MSVCRT ref: 61CD3798
fprintf.MSVCRT ref: 61CD37B9
fputc.MSVCRT ref: 61CD37D2
fwrite.MSVCRT ref: 61CD37F3
malloc.MSVCRT ref: 61CD37FD
fwrite.MSVCRT ref: 61CD3B97
fwrite.MSVCRT ref: 61CD3BB8
fwrite.MSVCRT ref: 61CD3BD9
fwrite.MSVCRT ref: 61CD3BFA

Strings

Failed to get mac address., xrefs: 61CD3BA3
%02x:, xrefs: 61CD3AAE
Default Mac address: "%s", xrefs: 61CD362B
Multiple Mac addresses: "<, xrefs: 61CD37DE
>", xrefs: 61CD3B57
Serial number of default harddisk: "%s", xrefs: 61CD35CA
Ip address: "%s", xrefs: 61CD368D
Failed to get domain name., xrefs: 61CD3BE5
Change logsv6.2.0(r21): Remove trailing dot from harddisk serial numberv6.4.2(r34): Support binding multiple mac addressesv6.5.3(r37): Support binding named harddiskv6.7.5(r45): Support mmc/sd card in Linux, xrefs: 61CD36E9
%02x, xrefs: 61CD3B0D
Failed to get harddisk information., xrefs: 61CD3B82
Hardware informations got by PyArmor:, xrefs: 61CD3586
Serial number with disk name: , xrefs: 61CD374E
Failed to get ip address., xrefs: 61CD3BC4
Domain name: "%s", xrefs: 61CD36D0
"%s", xrefs: 61CD376D, 61CD37AC

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Heap$Processfwrite$fprintf$AllocFreefputc$AdaptersAddressesstrchrstrlen$NetworkParamsinet_ntoamallocmemcpy
String ID: "%s"$Change logsv6.2.0(r21): Remove trailing dot from harddisk serial numberv6.4.2(r34): Support binding multiple mac addressesv6.5.3(r37): Support binding named harddiskv6.7.5(r45): Support mmc/sd card in Linux$%02x$%02x:$>"$Default Mac address: "%s"$Domain name: "%s"$Failed to get domain name.$Failed to get harddisk information.$Failed to get ip address.$Failed to get mac address.$Hardware informations got by PyArmor:$Ip address: "%s"$Multiple Mac addresses: "<$Serial number of default harddisk: "%s"$Serial number with disk name:
API String ID: 3427000353-3771683696
Opcode ID: 1cb2a9057d3561845ba2c116d12d60171105c6080ccf3f43278611e0ae2cae7e
Instruction ID: 70830e5f0fa44e062a6ca1230464fe1aad51617140ffd3458f92ca08d60caf46
Opcode Fuzzy Hash: 1cb2a9057d3561845ba2c116d12d60171105c6080ccf3f43278611e0ae2cae7e
Instruction Fuzzy Hash: 2902DBB2705B8086EB50CBA6E45139E77A2F789BD4F08922ACF9D47794EF39C051CB11

Function 61CD3FD0 Relevance: 72.1, APIs: 35, Strings: 6, Instructions: 355networkstringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 61CD3FF2
WSAStartup.WS2_32 ref: 61CD4004
gethostbyname.WS2_32 ref: 61CD4049
socket.WS2_32 ref: 61CD4086
htons.WS2_32 ref: 61CD40AD
ioctlsocket.WS2_32 ref: 61CD40E2
connect.WS2_32 ref: 61CD40FA
ioctlsocket.WS2_32 ref: 61CD411C
send.WS2_32 ref: 61CD4154
WSAGetLastError.WS2_32 ref: 61CD415D
closesocket.WS2_32 ref: 61CD4168
WSACleanup.WS2_32 ref: 61CD416E
SetLastError.KERNEL32 ref: 61CD4176
recv.WS2_32 ref: 61CD41CC
closesocket.WS2_32 ref: 61CD41E4
WSACleanup.WS2_32 ref: 61CD41EA
strstr.MSVCRT ref: 61CD41FA
strstr.MSVCRT ref: 61CD4225
toupper.MSVCRT ref: 61CD423A
toupper.MSVCRT ref: 61CD4249
toupper.MSVCRT ref: 61CD4258
toupper.MSVCRT ref: 61CD4267
strstr.MSVCRT ref: 61CD42C8
memcmp.MSVCRT ref: 61CD437F
memcmp.MSVCRT ref: 61CD439D
_mktime64.MSVCRT ref: 61CD4444
gethostbyname.WS2_32 ref: 61CD447E
WSAGetLastError.WS2_32 ref: 61CD4497
ioctlsocket.WS2_32 ref: 61CD44B4
WSAGetLastError.WS2_32 ref: 61CD44B6
WSAGetLastError.WS2_32 ref: 61CD44C0
WSACleanup.WS2_32 ref: 61CD44C8
SetLastError.KERNEL32 ref: 61CD44D0
select.WS2_32 ref: 61CD454A
ioctlsocket.WS2_32 ref: 61CD4566

Strings

http://, xrefs: 61CD3FD9
HEAD /%s HTTP/1.1Host: %sUser-Agent: PYARMOR.COREConnection: close, xrefs: 61CD4027, 61CD445F
Nov, xrefs: 61CD436F
or,, xrefs: 61CD3FD6
and,, xrefs: 61CD3FDB
Dec, xrefs: 61CD438D

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: ErrorLast$ioctlsockettoupper$Cleanupstrstr$closesocketgethostbynamememcmp$Startup_mktime64connecthtonsrecvselectsendsocketstrchr
String ID: Dec$HEAD /%s HTTP/1.1Host: %sUser-Agent: PYARMOR.COREConnection: close$Nov$and,$http://$or,
API String ID: 3493847099-1714119496
Opcode ID: 09abbbf94266815d4de85c1b699209a521172ab132b339a5765da79f4a0ecc6a
Instruction ID: a72bfaf24faa03f4997299a80f4da17f46208d91d52b480b066052d9591d71ad
Opcode Fuzzy Hash: 09abbbf94266815d4de85c1b699209a521172ab132b339a5765da79f4a0ecc6a
Instruction Fuzzy Hash: 20E1D132A09AC1D1E711CBA5E4407AE7BB1F385B98F48C226CB6947B98FB3DD146C741

Function 00007FFB0BC21B40 Relevance: 65.2, APIs: 20, Strings: 17, Instructions: 442COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_reset.LIBCRYPTO-1_1 ref: 00007FFB0BC8AB6F
EVP_CIPHER_CTX_new.LIBCRYPTO-1_1 ref: 00007FFB0BC8AB92
EVP_CIPHER_CTX_reset.LIBCRYPTO-1_1 ref: 00007FFB0BC8ABEA
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FFB0BC8AC7C
EVP_CIPHER_CTX_new.LIBCRYPTO-1_1 ref: 00007FFB0BC8AC93
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB0BC8AD31
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FFB0BC8AFC3
memcpy.VCRUNTIME140 ref: 00007FFB0BC8B08A
memcpy.VCRUNTIME140 ref: 00007FFB0BC8B0A9
memcpy.VCRUNTIME140 ref: 00007FFB0BC8B192
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FFB0BC8B2D2

Strings

exp master, xrefs: 00007FFB0BC8B1AE
c ap traffic, xrefs: 00007FFB0BC8AC36, 00007FFB0BC8B0AE, 00007FFB0BC8B114
SERVER_TRAFFIC_SECRET_0, xrefs: 00007FFB0BC8ACBF
..\s\ssl\tls13_enc.c, xrefs: 00007FFB0BC8ABB0, 00007FFB0BC8AD4B, 00007FFB0BC8ADB0, 00007FFB0BC8ADEE, 00007FFB0BC8AE1E, 00007FFB0BC8AF30, 00007FFB0BC8AF76
c e traffic, xrefs: 00007FFB0BC8AC2F, 00007FFB0BC8B2A0
SERVER_HANDSHAKE_TRAFFIC_SECRET, xrefs: 00007FFB0BC8AC8A
s hs traffic, xrefs: 00007FFB0BC8AC3D, 00007FFB0BC8B08F
CLIENT_EARLY_TRAFFIC_SECRET, xrefs: 00007FFB0BC8AD1A
EARLY_EXPORTER_SECRET, xrefs: 00007FFB0BC8AF55
res master, xrefs: 00007FFB0BC8B0D1
e exp master, xrefs: 00007FFB0BC8AEE6
c hs traffic, xrefs: 00007FFB0BC8AFD6
CLIENT_TRAFFIC_SECRET_0, xrefs: 00007FFB0BC8AFEF
finished, xrefs: 00007FFB0BC8B25C
s ap traffic, xrefs: 00007FFB0BC8AC1A, 00007FFB0BC8B070, 00007FFB0BC8B172
CLIENT_HANDSHAKE_TRAFFIC_SECRET, xrefs: 00007FFB0BC8AFC8
EXPORTER_SECRET, xrefs: 00007FFB0BC8B1F7

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: memcpy$D_sizeX_newX_reset$L_cleanseO_ctrl
String ID: ..\s\ssl\tls13_enc.c$CLIENT_EARLY_TRAFFIC_SECRET$CLIENT_HANDSHAKE_TRAFFIC_SECRET$CLIENT_TRAFFIC_SECRET_0$EARLY_EXPORTER_SECRET$EXPORTER_SECRET$SERVER_HANDSHAKE_TRAFFIC_SECRET$SERVER_TRAFFIC_SECRET_0$c ap traffic$c e traffic$c hs traffic$e exp master$exp master$finished$res master$s ap traffic$s hs traffic
API String ID: 804632375-2823458745
Opcode ID: 10a871ee4789da1238021743094fe44da3fee0b4ed5f17071a15f399aa217030
Instruction ID: a39f51e47c0dcd2c28253337ea10630552e5a93c97062f3b2abc2876b821269a
Opcode Fuzzy Hash: 10a871ee4789da1238021743094fe44da3fee0b4ed5f17071a15f399aa217030
Instruction Fuzzy Hash: 57228CB1A08B42B6EA209B71E940BAD77A4FB44788F448136EA4E87B75DF3CE551C700

Function 61CC8280 Relevance: 51.0, APIs: 24, Strings: 5, Instructions: 201COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON310 ref: 61CC82A1
PyTuple_New.PYTHON310 ref: 61CC82AD
_PyObject_LookupAttr.PYTHON310 ref: 61CC830F
_PyObject_GetAttrId.PYTHON310 ref: 61CC8323
PyModule_GetFilenameObject.PYTHON310 ref: 61CC834F
PyUnicode_FromString.PYTHON310 ref: 61CC835F
_PyErr_Clear.PYTHON310 ref: 61CC8399
PyErr_SetImportError.PYTHON310 ref: 61CC83BF
_Py_Dealloc.PYTHON310 ref: 61CC83DE

Strings

cannot import name %R from %R (unknown location), xrefs: 61CC83A5
cannot import name %R from partially initialized module %R (most likely due to a circular import) (%S), xrefs: 61CC8505
%U.%U, xrefs: 61CC8432
<unknown module name>, xrefs: 61CC8358
cannot import name %R from %R (%S), xrefs: 61CC84EA

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: AttrErr_Object_Tuple_$ClearDeallocErrorFilenameFromImportLookupModule_ObjectSizeStringUnicode_
String ID: %U.%U$<unknown module name>$cannot import name %R from %R (%S)$cannot import name %R from %R (unknown location)$cannot import name %R from partially initialized module %R (most likely due to a circular import) (%S)
API String ID: 597108667-3215622635
Opcode ID: 1d01639cebfca87aad6507c8a55bc06ae9ad0b57a0cda341e4a785c28dc79153
Instruction ID: 846dc7c2789a564130c25b8b1403b30798470c5fd7b3d57aea14c81f159b1c7d
Opcode Fuzzy Hash: 1d01639cebfca87aad6507c8a55bc06ae9ad0b57a0cda341e4a785c28dc79153
Instruction Fuzzy Hash: 90719632606A84E5EA05CFA6A858B9F77A2B786FD4F0C8024DE4E07724EF3DC565D341

Function 61CC9FE0 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 252COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CC9FF1
_PyLong_New.PYTHON310 ref: 61CCA046
PyErr_Occurred.PYTHON310 ref: 61CCA0BF
PyErr_Occurred.PYTHON310 ref: 61CCA18A
PyErr_SetString.PYTHON310 ref: 61CCA1CA
PyErr_Occurred.PYTHON310 ref: 61CCA560
_PyLong_New.PYTHON310 ref: 61CCABCB
PyErr_SetString.PYTHON310 ref: 61CCB4D6

Strings

bad marshal data (unnormalized long data), xrefs: 61CCB56D
bad marshal data (long size out of range), xrefs: 61CCB4CC
bad marshal data (digit out of range in long), xrefs: 61CCA1C0

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$Occurred$Long_String
String ID: bad marshal data (digit out of range in long)$bad marshal data (long size out of range)$bad marshal data (unnormalized long data)
API String ID: 3688822742-2912230410
Opcode ID: 192796dbefc56ede9b18ce28a6c2ebdc212bb3e6c9299d6dd94916cbefc70d92
Instruction ID: 9052dcdaeb30962fd71599a883db609cd0d780bc1c26a7a571b9d2dab01d84d9
Opcode Fuzzy Hash: 192796dbefc56ede9b18ce28a6c2ebdc212bb3e6c9299d6dd94916cbefc70d92
Instruction Fuzzy Hash: D5A14736206B90C6EA10CBAAD58475E73A2F785F84F19C115CE9E47714EF38E859CB81

Function 61CCE7B0 Relevance: 35.5, APIs: 19, Strings: 1, Instructions: 472fileCOMMON

Download Yara Rule

APIs

_Py_hashtable_new_full.PYTHON310 ref: 61CCE837
_Py_hashtable_destroy.PYTHON310 ref: 61CCE874
fwrite.MSVCRT ref: 61CCE891
PyErr_NoMemory.PYTHON310 ref: 61CCE962
fwrite.MSVCRT ref: 61CCEFBA

Strings

too many objects, xrefs: 61CCED37

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: fwrite$Err_MemoryPy_hashtable_destroyPy_hashtable_new_full
String ID: too many objects
API String ID: 3535940709-4209268247
Opcode ID: 072791276c24e4448f3269e92f613d27efc05ce62c5ecea9f5eda95fc2d141ee
Instruction ID: ed4aab8f95326541c3ba7e33ba32342ff73df5dade6b831cb5f249b6d96c7789
Opcode Fuzzy Hash: 072791276c24e4448f3269e92f613d27efc05ce62c5ecea9f5eda95fc2d141ee
Instruction Fuzzy Hash: 4D127D32209B84C6DB00CB9AE44179EBFA0F386BD0F548116EA9D07B68EB7DD455CB42

Function 61CD1D00 Relevance: 35.3, APIs: 16, Strings: 4, Instructions: 254COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 61CD1E4B
_Py_Dealloc.PYTHON310 ref: 61CD1E91
PyTuple_New.PYTHON310 ref: 61CD1F96
PyDict_GetItem.PYTHON310 ref: 61CD207F
PyDict_DelItem.PYTHON310 ref: 61CD20A7
PyErr_SetString.PYTHON310 ref: 61CD20D4

Strings

missing required positional arguments, xrefs: 61CD1E41
missing kwonly required arguments, xrefs: 61CD20CA
too many positional arguments, xrefs: 61CD2134
Can't remove argname from kwargs, xrefs: 61CD1F26

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Dict_Err_ItemString$DeallocTuple_
String ID: Can't remove argname from kwargs$missing kwonly required arguments$missing required positional arguments$too many positional arguments
API String ID: 2174600326-1903473336
Opcode ID: d3dba25277e8a6c7e83277ad3c4a6ba8b65aef718266c3b2fd206c8b46e4a09e
Instruction ID: 3b094aa62efd5e344aa4d6f53361da9261d7521f0de528d7bf5b3be55a108304
Opcode Fuzzy Hash: d3dba25277e8a6c7e83277ad3c4a6ba8b65aef718266c3b2fd206c8b46e4a09e
Instruction Fuzzy Hash: 15B13A72A45B84C1EB269FA9E85439E7776F785BA4F188211CF6D03B68EF39C095C301

Function 61CD08F0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 180COMMON

Download Yara Rule

APIs

PyObject_GetIter.PYTHON310 ref: 61CD0937
PyIter_Next.PYTHON310 ref: 61CD0988
PyErr_Occurred.PYTHON310 ref: 61CD0990
_Py_Dealloc.PYTHON310 ref: 61CD09CA
_Py_Dealloc.PYTHON310 ref: 61CD09DB
Py_DecRef.PYTHON310 ref: 61CD09E4
Py_DecRef.PYTHON310 ref: 61CD0A2D
PyIter_Next.PYTHON310 ref: 61CD0A48
PyErr_Format.PYTHON310 ref: 61CD0A6E
PyErr_ExceptionMatches.PYTHON310 ref: 61CD0ACA
PySequence_Check.PYTHON310 ref: 61CD0AEE
PyErr_Format.PYTHON310 ref: 61CD0B0F

Strings

not enough values to unpack (expected %d, got %d), xrefs: 61CD0B2D
too many values to unpack (expected %d), xrefs: 61CD0A64
cannot unpack non-iterable %.200s object, xrefs: 61CD0B01

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$DeallocFormatIter_Next$CheckExceptionIterMatchesObject_OccurredSequence_
String ID: cannot unpack non-iterable %.200s object$not enough values to unpack (expected %d, got %d)$too many values to unpack (expected %d)
API String ID: 2492064420-2953850414
Opcode ID: fe2cb6f2749073ae5222a0c3e1dd4c278759d1a17c65bec1c8ad99c02bb32464
Instruction ID: 688ce6252d478ce979eb353606bfd7547f376596185337da579519863100f07e
Opcode Fuzzy Hash: fe2cb6f2749073ae5222a0c3e1dd4c278759d1a17c65bec1c8ad99c02bb32464
Instruction Fuzzy Hash: 08619C32B06A84D2EA058F6EE85439D37B1F749B99F098612CF1E83724EF39C0A5C340

Function 00007FFB0BA31EE0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 76COMMON

Download Yara Rule

APIs

PyModule_Create2.PYTHON310 ref: 00007FFB0BA31F01
PyErr_NewException.PYTHON310 ref: 00007FFB0BA31F16
PyModule_AddObject.PYTHON310 ref: 00007FFB0BA31F38
PyType_Ready.PYTHON310 ref: 00007FFB0BA31F45
PyModule_AddObject.PYTHON310 ref: 00007FFB0BA31F6B
PyType_Ready.PYTHON310 ref: 00007FFB0BA31F78
PyModule_AddObject.PYTHON310 ref: 00007FFB0BA31F9E
PyModule_AddIntConstant.PYTHON310 ref: 00007FFB0BA31FB1
PyModule_AddIntConstant.PYTHON310 ref: 00007FFB0BA31FC7
PyModule_AddIntConstant.PYTHON310 ref: 00007FFB0BA31FDD
PyModule_AddStringConstant.PYTHON310 ref: 00007FFB0BA3201D

Strings

MODE_TEXT, xrefs: 00007FFB0BA31FBD
error, xrefs: 00007FFB0BA31F2B
brotli.error, xrefs: 00007FFB0BA31F0A
Compressor, xrefs: 00007FFB0BA31F61
%d.%d.%d, xrefs: 00007FFB0BA31FF1
MODE_GENERIC, xrefs: 00007FFB0BA31FA7
Decompressor, xrefs: 00007FFB0BA31F94
__version__, xrefs: 00007FFB0BA32016
MODE_FONT, xrefs: 00007FFB0BA31FD3

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: Module_$Constant$Object$ReadyType_$Create2Err_ExceptionString
String ID: %d.%d.%d$Compressor$Decompressor$MODE_FONT$MODE_GENERIC$MODE_TEXT$__version__$brotli.error$error
API String ID: 85873462-3709432877
Opcode ID: c527ea57f1a6fa79dc78c15721b8764123cc718b26bb66bf4bdf31074b340112
Instruction ID: 1d31d67f51e2f07c1c563cd8bf595eb55bb987b85e1a6c402930bdc1c4236589
Opcode Fuzzy Hash: c527ea57f1a6fa79dc78c15721b8764123cc718b26bb66bf4bdf31074b340112
Instruction Fuzzy Hash: 6531F9A1E18A0392FA059F71E864AB52361FF59B84F849032DD0FC6A74EF3CE549C740

Function 61CCA2A3 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 172threadCOMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CCA2B4
PyThreadState_Get.PYTHON310 ref: 61CCAA73
_Py_CheckFunctionResult.PYTHON310 ref: 61CCAABE

Strings

NULL object in marshal data for set, xrefs: 61CCB6B2
bad marshal data (set size out of range), xrefs: 61CCB204
bad marshal data (index list too large), xrefs: 61CCB707

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: CheckErr_FunctionOccurredResultState_Thread
String ID: NULL object in marshal data for set$bad marshal data (index list too large)$bad marshal data (set size out of range)
API String ID: 3239669425-600355161
Opcode ID: 6966b5a4f492ad5c447b097c62582c69bb00ca4d9ddb40f0a3e017ff77267a8d
Instruction ID: 1eb1d6ca7885e91470581e5bf97e86a8644e5a3f277157bfaf0dbd5e46ccf62d
Opcode Fuzzy Hash: 6966b5a4f492ad5c447b097c62582c69bb00ca4d9ddb40f0a3e017ff77267a8d
Instruction Fuzzy Hash: 04716E31205B84C2EA64CBAAE44875E37A2F785F94F08C519CD6E07764FF39C858C782

Function 61CCDF60 Relevance: 32.0, APIs: 17, Strings: 1, Instructions: 473fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61CCE1E5
PyErr_SetString.PYTHON310 ref: 61CCE478
fwrite.MSVCRT ref: 61CCE6A0

Strings

too many objects, xrefs: 61CCE46E

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: fwrite$Err_String
String ID: too many objects
API String ID: 4210527972-4209268247
Opcode ID: ab538bb19e1f1bc414fd6b896064fc33ca10a26fd2367afd18da7291b42768a6
Instruction ID: c675d4aba6397622fd26a9bab8be20c2511ff2fb7e6e8672a75657d89d28086c
Opcode Fuzzy Hash: ab538bb19e1f1bc414fd6b896064fc33ca10a26fd2367afd18da7291b42768a6
Instruction Fuzzy Hash: 7E126FB2201B84C6DB14CFAAD04178D7BB1F746FE8F548216CA6D57758EB39C9A2C381

Function 61CC87F0 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

_PyFloat_Unpack8.PYTHON310 ref: 61CC8821
PyBuffer_FillInfo.PYTHON310 ref: 61CC8876
PyMemoryView_FromBuffer.PYTHON310 ref: 61CC8884
_PyObject_CallMethodId_SizeT.PYTHON310 ref: 61CC88A4
PyNumber_AsSsize_t.PYTHON310 ref: 61CC88C3
PyErr_SetString.PYTHON310 ref: 61CC89F1

Strings

marshal data too short, xrefs: 61CC89E7
read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61CC89C5
EOF read where not expected, xrefs: 61CC8952

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: BufferBuffer_CallErr_FillFloat_FromInfoMemoryMethodNumber_Object_SizeSsize_tStringUnpack8View_
String ID: EOF read where not expected$marshal data too short$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 3670709071-4172231876
Opcode ID: 5953b7188b458796bec9ddd9ceeaae1fcaf63df668c975a6eba10f85afc1e8d2
Instruction ID: 2b5349b9d9ddfca7ebf6e2f708b049a935310588ad32c63c411f64716e6d45fc
Opcode Fuzzy Hash: 5953b7188b458796bec9ddd9ceeaae1fcaf63df668c975a6eba10f85afc1e8d2
Instruction Fuzzy Hash: FF517431316A00C1EB059FAAE840B9E3371F745FE9F488215C92D477A8EF39C899D382

Function 61CC4050 Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 201COMMON

Download Yara Rule

APIs

_time64.MSVCRT ref: 61CC41A0
PyErr_Format.PYTHON310 ref: 61CC4248

Strings

*IFMAC:, xrefs: 61CC1E6F, 61CC2133
N+, xrefs: 61CC429D
*MID:, xrefs: 61CC1E2C
*IFIPV6:, xrefs: 61CC1EA9
%s (%d:%d), xrefs: 61CC1F36, 61CC2050, 61CC2573, 61CC25E3, 61CC2872, 61CC28DC, 61CC2946, 61CC29B0, 61CC2A23, 61CC4241, 61CC42AB
*DOMAIN:, xrefs: 61CC1EC6
9, xrefs: 61CC2685
*IFIPV4:, xrefs: 61CC1E8C
*HARDDISK:, xrefs: 61CC1E4F

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_Format_time64
String ID: %s (%d:%d)$*DOMAIN:$*HARDDISK:$*IFIPV4:$*IFIPV6:$*IFMAC:$*MID:$9$N+
API String ID: 3213601273-243345976
Opcode ID: a1d82c480142157980b356fb9d39d517d3fc47aba4f216445493419fe1ec8879
Instruction ID: 58c30c1de830392695638108277f9645988f45368220b0d205fdd87ce4128200
Opcode Fuzzy Hash: a1d82c480142157980b356fb9d39d517d3fc47aba4f216445493419fe1ec8879
Instruction Fuzzy Hash: 4271C232745694C6FB018F75D49039D3B72F781F99F4CC212DAA80B794EB2AC956C712

Function 61CC8A20 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

PyBuffer_FillInfo.PYTHON310 ref: 61CC8AA6
PyMemoryView_FromBuffer.PYTHON310 ref: 61CC8AB4
_PyObject_CallMethodId_SizeT.PYTHON310 ref: 61CC8AD4
PyNumber_AsSsize_t.PYTHON310 ref: 61CC8AF3
PyErr_SetString.PYTHON310 ref: 61CC8C21

Strings

marshal data too short, xrefs: 61CC8C17
read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61CC8BF5
EOF read where not expected, xrefs: 61CC8B82

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: BufferBuffer_CallErr_FillFromInfoMemoryMethodNumber_Object_SizeSsize_tStringView_
String ID: EOF read where not expected$marshal data too short$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 3120701247-4172231876
Opcode ID: 268cca4879bc0949d5ef2498795e136865965a24cbf26e512078b88c3e68cf09
Instruction ID: 39c0ddd4696da011d630d6f6b29fee9b86b045f942c346f7cfed99518e282246
Opcode Fuzzy Hash: 268cca4879bc0949d5ef2498795e136865965a24cbf26e512078b88c3e68cf09
Instruction Fuzzy Hash: 4D412DB1306A04C1EE058BA9D854B5E3361B749FF8F188715CA2D47BE8EF39C896D341

Function 61CC8D80 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

PyBuffer_FillInfo.PYTHON310 ref: 61CC8E02
PyMemoryView_FromBuffer.PYTHON310 ref: 61CC8E10
_PyObject_CallMethodId_SizeT.PYTHON310 ref: 61CC8E30
PyNumber_AsSsize_t.PYTHON310 ref: 61CC8E52
PyErr_Occurred.PYTHON310 ref: 61CC8E6B
PyErr_Format.PYTHON310 ref: 61CC8E9A
PyErr_SetString.PYTHON310 ref: 61CC8F43

Strings

marshal data too short, xrefs: 61CC8F37
read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61CC8E90
EOF read where not expected, xrefs: 61CC8F17

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$BufferBuffer_CallFillFormatFromInfoMemoryMethodNumber_Object_OccurredSizeSsize_tStringView_
String ID: EOF read where not expected$marshal data too short$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 2192429850-4172231876
Opcode ID: 70caecf7664a3d6fa08ce6f90253df570e7e05374acd81b3be3a96d3682d0a00
Instruction ID: c4f67647144f5eca8f866616ff93eaf0cc2b62e4dfd0a92a2be41dc9206f7581
Opcode Fuzzy Hash: 70caecf7664a3d6fa08ce6f90253df570e7e05374acd81b3be3a96d3682d0a00
Instruction Fuzzy Hash: DA413031302A05C5EA159F6AE840B9A3362B759FF4F4C87258E2D477E4EF39C895D381

Function 61CD0BB0 Relevance: 27.2, APIs: 18, Instructions: 153COMMON

Download Yara Rule

APIs

PyObject_Call.PYTHON310 ref: 61CD0C62
PyErr_CheckSignals.PYTHON310 ref: 61CD0C97
_Py_Dealloc.PYTHON310 ref: 61CD0CB5
_Py_Dealloc.PYTHON310 ref: 61CD0CC3
_Py_Dealloc.PYTHON310 ref: 61CD0CD3

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Dealloc$CallCheckErr_Object_Signals
String ID:
API String ID: 356930793-0
Opcode ID: 5c47cf7f93ec0070e06dcdb2ba8344a8992b5d22951f6b8c72dadad077147798
Instruction ID: 5f7d1762232fdd679596d89c4661962021036ada5b2e659c4b7dff6ab997be56
Opcode Fuzzy Hash: 5c47cf7f93ec0070e06dcdb2ba8344a8992b5d22951f6b8c72dadad077147798
Instruction Fuzzy Hash: 7D513032A4AA50E6EA099FAE995436D3B71FB86B95F0CC115CF1986A10FF3AC075C341

Function 00007FFB0BA31C80 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON310 ref: 00007FFB0BA31CB9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFB0BA31CF3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFB0BA31D13
PyBytes_FromStringAndSize.PYTHON310 ref: 00007FFB0BA31D3B
PyList_New.PYTHON310 ref: 00007FFB0BA31D52
_Py_Dealloc.PYTHON310 ref: 00007FFB0BA31D71
_Py_Dealloc.PYTHON310 ref: 00007FFB0BA31E67
PyErr_SetString.PYTHON310 ref: 00007FFB0BA31E7B
PyBuffer_Release.PYTHON310 ref: 00007FFB0BA31EAD

Strings

BrotliDecompress failed, xrefs: 00007FFB0BA31E74
y*|:decompress, xrefs: 00007FFB0BA31CAA

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: DeallocSizeString$Arg_Buffer_Bytes_Err_FromKeywords_List_ParseReleaseTuplefreemalloc
String ID: BrotliDecompress failed$y*|:decompress
API String ID: 3129089932-3609120798
Opcode ID: 21fc62796acf40556abf5966d126bf01a84e1109d329ffa3a643c5993f22310f
Instruction ID: c3ab98524f4200d8543294eed5fac5171f729ae1b3061716c221405e9ef0d162
Opcode Fuzzy Hash: 21fc62796acf40556abf5966d126bf01a84e1109d329ffa3a643c5993f22310f
Instruction Fuzzy Hash: AB612872B09B4685EB619B71E4507AD23A5FB58F88F448436DE4EA3B68EF3CD405C340

Function 61CD2850 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 61CD2873
HeapAlloc.KERNEL32 ref: 61CD2887
GetAdaptersAddresses.IPHLPAPI ref: 61CD28AC
GetProcessHeap.KERNEL32 ref: 61CD291F
HeapFree.KERNEL32 ref: 61CD2929
GetProcessHeap.KERNEL32 ref: 61CD2940
HeapFree.KERNEL32 ref: 61CD294A
GetProcessHeap.KERNEL32 ref: 61CD2951
HeapAlloc.KERNEL32 ref: 61CD295B
GetAdaptersAddresses.IPHLPAPI ref: 61CD2977

Strings

Too small size, xrefs: 61CD29A0
%02x:%02x:%02x:%02x:%02x:%02x, xrefs: 61CD28E9
../src/platforms/windows/hdinfo.c, xrefs: 61CD29A7

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Heap$Process$AdaptersAddressesAllocFree
String ID: %02x:%02x:%02x:%02x:%02x:%02x$../src/platforms/windows/hdinfo.c$Too small size
API String ID: 1283795797-3992030336
Opcode ID: 28b741a99f7261f51883bf318de66afc32225d72aa7120d1a0b8f8e9456b4b24
Instruction ID: cc247c1afe25794d4e03ce20905666fbc3378b04d95cca62958e6e8b3e98b663
Opcode Fuzzy Hash: 28b741a99f7261f51883bf318de66afc32225d72aa7120d1a0b8f8e9456b4b24
Instruction Fuzzy Hash: 7831EB227055918AD721DBBBAC1076EBB92FB89BD4F088126AE6C83794FF3CC141D750

Function 61CD0570 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

PyList_New.PYTHON310 ref: 61CD05A9
PyTuple_New.PYTHON310 ref: 61CD0613
PyList_New.PYTHON310 ref: 61CD0672
_PyList_Extend.PYTHON310 ref: 61CD06C0
_Py_Dealloc.PYTHON310 ref: 61CD06D4
PyDict_New.PYTHON310 ref: 61CD06E0
PyDict_Update.PYTHON310 ref: 61CD075F
_Py_Dealloc.PYTHON310 ref: 61CD0775

Strings

Invalid type for op_build, xrefs: 61CD07CC

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: List_$DeallocDict_$ExtendTuple_Update
String ID: Invalid type for op_build
API String ID: 3794787204-1006902009
Opcode ID: 7e77342aa9cbcc8bd41e1988bfb5005c4bd609e4d6c17d9bfdf0e27322b9733a
Instruction ID: 0e728dde6b8c332d667d89005810a0f758e26f9c1410ef71bb9a777c29456398
Opcode Fuzzy Hash: 7e77342aa9cbcc8bd41e1988bfb5005c4bd609e4d6c17d9bfdf0e27322b9733a
Instruction Fuzzy Hash: 5E51A172F45A04C1FE158BADA95039E27A1AB85BD4F99C016CF19C7714FE3EC066C744

Function 61CD1A20 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 61CD1A67
PyUnicode_New.PYTHON310 ref: 61CD1A84
PyObject_Format.PYTHON310 ref: 61CD1BAE
_Py_Dealloc.PYTHON310 ref: 61CD1BD3
_Py_Dealloc.PYTHON310 ref: 61CD1C68

Strings

Too many format strings, xrefs: 61CD1A5D

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Dealloc$Err_FormatObject_StringUnicode_
String ID: Too many format strings
API String ID: 3094464462-2091874682
Opcode ID: a705662501f43c819613764881bd771d26779ffa5ebd9b20d4251b7b3115279a
Instruction ID: 4057101ab3f4cc9149257db631a78edf69700d5526fc5087cd0b324b24e3b287
Opcode Fuzzy Hash: a705662501f43c819613764881bd771d26779ffa5ebd9b20d4251b7b3115279a
Instruction Fuzzy Hash: 00516D72A49A44E1EA198FAEA9843AD73B2B785BC4F088125CB5E47B14FF3DC165C341

Function 61CC1A30 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 174COMMON

Download Yara Rule

APIs

PyEval_GetFrame.PYTHON310 ref: 61CC1A3E
PyUnicode_AsUTF8.PYTHON310 ref: 61CC1A98
PyModule_GetDict.PYTHON310 ref: 61CC1AAF
PyDict_GetItemString.PYTHON310 ref: 61CC1AC8
PyCFunction_GetSelf.PYTHON310 ref: 61CC1AD6
PyErr_Format.PYTHON310 ref: 61CC1B3C

Strings

protection exception (%d), xrefs: 61CC1B57, 61CC1C66
__pyarmor__, xrefs: 61CC1ABE
%s (%d:%d), xrefs: 61CC1B27
__dict__, xrefs: 61CC1B8A

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: DictDict_Err_Eval_FormatFrameFunction_ItemModule_SelfStringUnicode_
String ID: %s (%d:%d)$__dict__$__pyarmor__$protection exception (%d)
API String ID: 3372622024-629680938
Opcode ID: 6bfe40150e7f323fbba23a91d001a579904c506e38e2ed717feda4512c651a80
Instruction ID: 234c18b7cfe7fc8ade27eb0f60418ada055488fb65bed6bb59210fad97f64f17
Opcode Fuzzy Hash: 6bfe40150e7f323fbba23a91d001a579904c506e38e2ed717feda4512c651a80
Instruction Fuzzy Hash: E2515C76701A44D1FF058FABE8507A82BB2EB88FD4F498426CE1D07765EE39C895C741

Function 61CD23A0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

PyFunction_NewWithQualName.PYTHON310 ref: 61CD240D
PyTuple_GetItem.PYTHON310 ref: 61CD2439
PyType_IsSubtype.PYTHON310 ref: 61CD2460
PyCMethod_New.PYTHON310 ref: 61CD24B5
PyTuple_SetItem.PYTHON310 ref: 61CD24CF
_Py_Dealloc.PYTHON310 ref: 61CD24E3
_Py_Dealloc.PYTHON310 ref: 61CD24FA
_Py_Dealloc.PYTHON310 ref: 61CD2547
PyCMethod_New.PYTHON310 ref: 61CD258C
Py_BuildValue.PYTHON310 ref: 61CD25A8

Strings

(O), xrefs: 61CD25A1

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Dealloc$ItemMethod_Tuple_$BuildFunction_NameQualSubtypeType_ValueWith
String ID: (O)
API String ID: 593819998-4232840684
Opcode ID: f996168bd4447b76efc63ff61f3011959f01f199160fab59cd60a4f5e19290e4
Instruction ID: fa29925a19540fc8f03d9aafb25c8a1fb30cb968d1d36d36746d9991aa1e33fb
Opcode Fuzzy Hash: f996168bd4447b76efc63ff61f3011959f01f199160fab59cd60a4f5e19290e4
Instruction Fuzzy Hash: 4251A032A46A50D2EA168FB6A974B9E77B1FB46B94F48C114CF5B06B14FF39C054C340

Function 61CCF210 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

_Py_fstat_noraise.PYTHON310 ref: 61CCF22D
PyMem_Malloc.PYTHON310 ref: 61CCF256
PyList_New.PYTHON310 ref: 61CCF281
PyErr_Occurred.PYTHON310 ref: 61CCF29B
PyMem_Free.PYTHON310 ref: 61CCF2CB
fread.MSVCRT ref: 61CCF2EE
PyMarshal_ReadObjectFromString.PYTHON310 ref: 61CCF2F9
PyMem_Free.PYTHON310 ref: 61CCF305

Strings

NULL object in marshal data for object, xrefs: 61CCF344
XXX readobject called with exception set, xrefs: 61CCF36D

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Mem_$Free$Err_FromList_MallocMarshal_ObjectOccurredPy_fstat_noraiseReadStringfread
String ID: NULL object in marshal data for object$XXX readobject called with exception set
API String ID: 149595394-3392712392
Opcode ID: 101779795f61d800918a771dc5683649c7a9ea3139cc4827061a833edcdae384
Instruction ID: 1b5d004c1532a33441219fd3cdabc34ff390500a99e55cc5875ead301bf4bff3
Opcode Fuzzy Hash: 101779795f61d800918a771dc5683649c7a9ea3139cc4827061a833edcdae384
Instruction Fuzzy Hash: 2E31AD31306B40C9FA068BA6E8047AD67A2AB86FD8F0C8135DE0E57754FF3DC4968741

Function 00007FFB0BA319E0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON310 ref: 00007FFB0BA31A04
PyBytes_FromStringAndSize.PYTHON310 ref: 00007FFB0BA31A6A
PyList_New.PYTHON310 ref: 00007FFB0BA31A80
_Py_Dealloc.PYTHON310 ref: 00007FFB0BA31A9F
_Py_Dealloc.PYTHON310 ref: 00007FFB0BA31B8F
PyErr_SetString.PYTHON310 ref: 00007FFB0BA31BA3
PyBuffer_Release.PYTHON310 ref: 00007FFB0BA31BB0

Strings

y*:process, xrefs: 00007FFB0BA319FA
BrotliDecoderDecompressStream failed while processing the stream, xrefs: 00007FFB0BA31B9C

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: DeallocSizeString$Arg_Buffer_Bytes_Err_FromList_ParseReleaseTuple_
String ID: BrotliDecoderDecompressStream failed while processing the stream$y*:process
API String ID: 2327171786-3378180327
Opcode ID: 0409f8f06fc8815c48b07b2be836251baa69eb390988694566013f5be1359561
Instruction ID: 1e090236940f5db07109485313c6768cb29bc93e1ff60d0ea4f48a4ea8c77e5b
Opcode Fuzzy Hash: 0409f8f06fc8815c48b07b2be836251baa69eb390988694566013f5be1359561
Instruction Fuzzy Hash: C95128B2F09B4689EB119F75E4507A963A4FB58B88F448036DE4EA7B68EF3CD454C340

Function 61CC85D0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

PyBuffer_FillInfo.PYTHON310 ref: 61CC8623
PyMemoryView_FromBuffer.PYTHON310 ref: 61CC8635
_PyObject_CallMethodId_SizeT.PYTHON310 ref: 61CC8659
PyNumber_AsSsize_t.PYTHON310 ref: 61CC867B
PyErr_Occurred.PYTHON310 ref: 61CC86A4
PyErr_Format.PYTHON310 ref: 61CC86CF
PyMem_Realloc.PYTHON310 ref: 61CC8703
_Py_Dealloc.PYTHON310 ref: 61CC8748
PyMem_Malloc.PYTHON310 ref: 61CC8773
PyErr_NoMemory.PYTHON310 ref: 61CC8785

Strings

read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61CC86BF
EOF read where not expected, xrefs: 61CC8727

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$Mem_Memory$BufferBuffer_CallDeallocFillFormatFromInfoMallocMethodNumber_Object_OccurredReallocSizeSsize_tView_
String ID: EOF read where not expected$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 3190434935-3742967138
Opcode ID: e485536d73254d4dafb8dc8a6effd36bb5055c745d6a8ed464dceacf089cae48
Instruction ID: 66854aef6b41a143c7d4d2bc4d79bf138f9a3d6f5aed3cce6501f806c3591011
Opcode Fuzzy Hash: e485536d73254d4dafb8dc8a6effd36bb5055c745d6a8ed464dceacf089cae48
Instruction Fuzzy Hash: E2418671301A04C5FB019BA6E94479E23A2B744FE8F488225CD2D57798FF3DC4AAD341

Function 61CDE930 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 319COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 61CDEB70
calloc.MSVCRT ref: 61CDEB87
free.MSVCRT ref: 61CDEBC8
free.MSVCRT ref: 61CDEBD0

Strings

modulus != NULL, xrefs: 61CDF00A
P != NULL, xrefs: 61CDEAE1
src/pk/ecc/ltc_ecc_map.c, xrefs: 61CDEADA
kB != NULL, xrefs: 61CDF023
B != NULL, xrefs: 61CDF06E
C != NULL, xrefs: 61CDF055
kA != NULL, xrefs: 61CDF03C
A != NULL, xrefs: 61CDF087
src/pk/ecc/ltc_ecc_mul2add.c, xrefs: 61CDF003, 61CDF01C, 61CDF035, 61CDF04E, 61CDF067, 61CDF080

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: callocfree
String ID: A != NULL$B != NULL$C != NULL$P != NULL$kA != NULL$kB != NULL$modulus != NULL$src/pk/ecc/ltc_ecc_map.c$src/pk/ecc/ltc_ecc_mul2add.c
API String ID: 306872129-190324370
Opcode ID: 4f33e5c8c7e94fbc85b603ddba97134baa48ed7034416edd1c7fef7426683878
Instruction ID: 3fc0ff90f08d2cbb04bd90e17459d14aee17383ab2978256765229971bc2a3ca
Opcode Fuzzy Hash: 4f33e5c8c7e94fbc85b603ddba97134baa48ed7034416edd1c7fef7426683878
Instruction Fuzzy Hash: 7DC18C32A04A90C6EB60DFA6E8447DEA7A5F788BD4F498026DF8997708FF78C445C740

Function 61D3FF60 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 123fileCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 61D3FFBE
CreateFileMappingA.KERNEL32 ref: 61D40015
MapViewOfFile.KERNEL32 ref: 61D40041
CloseHandle.KERNEL32 ref: 61D4004D
GetLastError.KERNEL32 ref: 61D40058
_errno.MSVCRT ref: 61D40060

Strings

@, xrefs: 61D4011D
@, xrefs: 61D400C4
, xrefs: 61D3FF9C

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: File_errno$CloseCreateErrorHandleLastMappingView
String ID: $@$@
API String ID: 896588047-3743272326
Opcode ID: 73e9286203a1371efb94ab06c35aaaace9818b0ebdf40b3641d022ac463382f6
Instruction ID: 9d0c6e662f27f0adb30c3b4ed28945bc07b1d2a009d5b9b8aab0390a329bac50
Opcode Fuzzy Hash: 73e9286203a1371efb94ab06c35aaaace9818b0ebdf40b3641d022ac463382f6
Instruction Fuzzy Hash: 8A413773A1166485F7618B96AC007896611BB9FBF4F498321EFB9573D0EB3CC844C780

Function 61CD1850 Relevance: 21.1, APIs: 14, Instructions: 93COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CD1881
PyErr_Fetch.PYTHON310 ref: 61CD18BF
PyErr_NormalizeException.PYTHON310 ref: 61CD18D7
PyException_SetTraceback.PYTHON310 ref: 61CD18F9
_Py_Dealloc.PYTHON310 ref: 61CD191B
PyErr_NormalizeException.PYTHON310 ref: 61CD192A
PyException_SetContext.PYTHON310 ref: 61CD1939
PyErr_Restore.PYTHON310 ref: 61CD194E
PyErr_Restore.PYTHON310 ref: 61CD197B
_Py_Dealloc.PYTHON310 ref: 61CD1983
PyEval_GetFrame.PYTHON310 ref: 61CD1990
PyErr_Restore.PYTHON310 ref: 61CD19B8
PyTraceBack_Here.PYTHON310 ref: 61CD19C3
PyErr_Fetch.PYTHON310 ref: 61CD19D7

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$Restore$DeallocExceptionException_FetchNormalize$Back_ContextEval_FrameHereOccurredTraceTraceback
String ID:
API String ID: 4214459649-0
Opcode ID: 827a9e5310f03d725a1cc348097ee629aec1fa18ce305dfd630c3ac3fe0b03ca
Instruction ID: 03515608dbe7a3419fb4cdaae0eeafe47c680109f5e3acfd865b0f3bbf488c2f
Opcode Fuzzy Hash: 827a9e5310f03d725a1cc348097ee629aec1fa18ce305dfd630c3ac3fe0b03ca
Instruction Fuzzy Hash: 07310576609BC594EA248BAAF84439FB772FB86BD4F488016DE8D43B28DF39C055C741

Function 61CD29E0 Relevance: 19.6, APIs: 13, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 61CD2A03
HeapAlloc.KERNEL32 ref: 61CD2A17
GetAdaptersAddresses.IPHLPAPI ref: 61CD2A3F
inet_ntoa.WS2_32 ref: 61CD2A77
GetProcessHeap.KERNEL32 ref: 61CD2A92
HeapFree.KERNEL32 ref: 61CD2A9C
GetProcessHeap.KERNEL32 ref: 61CD2AB0
HeapFree.KERNEL32 ref: 61CD2ABA
GetProcessHeap.KERNEL32 ref: 61CD2AC0
HeapAlloc.KERNEL32 ref: 61CD2ACA
GetAdaptersAddresses.IPHLPAPI ref: 61CD2AE9

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Heap$Process$AdaptersAddressesAllocFree$inet_ntoa
String ID:
API String ID: 4108032510-0
Opcode ID: f7741e468347a6813e1b085714e2c6c1d200df2b992c620632e7670310e4fb5c
Instruction ID: 7f52c52bcfd25b07cf680e6e6dc553f6b05a83ae718cbc96506c2af767ff3ffb
Opcode Fuzzy Hash: f7741e468347a6813e1b085714e2c6c1d200df2b992c620632e7670310e4fb5c
Instruction Fuzzy Hash: 0521262270165186EB24DBBBAC51B5E5692BBCABD4F09C236AE1D47394FF38D442C311

Function 61CC4D21 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 163threadCOMMON

Download Yara Rule

APIs

Part of subcall function 61CCF490: PyList_New.PYTHON310 ref: 61CCF4CB
Part of subcall function 61CCF490: PyErr_Occurred.PYTHON310 ref: 61CCF4EA
Part of subcall function 61CCF490: PyMem_Free.PYTHON310 ref: 61CCF518

_PyDict_GetItemIdWithError.PYTHON310 ref: 61CCFF62
PyThreadState_Get.PYTHON310 ref: 61CCFFC5
_Py_CheckFunctionResult.PYTHON310 ref: 61CD000F
_Py_Dealloc.PYTHON310 ref: 61CD0043
_PyObject_MakeTpCall.PYTHON310 ref: 61CD009A
_Py_Dealloc.PYTHON310 ref: 61CD00B0
_PyLong_AsInt.PYTHON310 ref: 61CD00F3
PyImport_ImportModuleLevelObject.PYTHON310 ref: 61CD011B
_Py_Dealloc.PYTHON310 ref: 61CD014D

Strings

__import__ not found, xrefs: 61CD00CC

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Dealloc$CallCheckDict_Err_ErrorFreeFunctionImportImport_ItemLevelList_Long_MakeMem_ModuleObjectObject_OccurredResultState_ThreadWith
String ID: __import__ not found
API String ID: 1209477609-2199325508
Opcode ID: 66a0ee9e62915a33e384d2420619a203a31e69856dba532ad039ce2488dfedf4
Instruction ID: 99020d0b4d098a0b6c2240efa479268f29d31c9c7fcf7f3126f77a6ca2c53b7f
Opcode Fuzzy Hash: 66a0ee9e62915a33e384d2420619a203a31e69856dba532ad039ce2488dfedf4
Instruction Fuzzy Hash: BE516C32605B84E6EB458B6AE94039E67A1F749FE4F089126DF4E47B24EF3DD0A5C300

Function 00007FFB0BC21C0D Relevance: 18.1, APIs: 12, Instructions: 126COMMON

Download Yara Rule

APIs

SCT_LIST_free.LIBCRYPTO-1_1 ref: 00007FFB0BC481B3
d2i_OCSP_RESPONSE.LIBCRYPTO-1_1 ref: 00007FFB0BC48208
OCSP_response_get1_basic.LIBCRYPTO-1_1 ref: 00007FFB0BC48218
OCSP_resp_count.LIBCRYPTO-1_1 ref: 00007FFB0BC4822A
OCSP_resp_get0.LIBCRYPTO-1_1 ref: 00007FFB0BC48238
OCSP_SINGLERESP_get1_ext_d2i.LIBCRYPTO-1_1 ref: 00007FFB0BC48250
OCSP_resp_count.LIBCRYPTO-1_1 ref: 00007FFB0BC48278
SCT_LIST_free.LIBCRYPTO-1_1 ref: 00007FFB0BC48284
OCSP_BASICRESP_free.LIBCRYPTO-1_1 ref: 00007FFB0BC4828C
OCSP_RESPONSE_free.LIBCRYPTO-1_1 ref: 00007FFB0BC48294
X509_get_ext_d2i.LIBCRYPTO-1_1 ref: 00007FFB0BC482CF
SCT_LIST_free.LIBCRYPTO-1_1 ref: 00007FFB0BC482F1

Part of subcall function 00007FFB0BC4C790: OPENSSL_sk_new_null.LIBCRYPTO-1_1(?,00007FFB0BC482EC), ref: 00007FFB0BC4C7C3
Part of subcall function 00007FFB0BC4C790: ERR_put_error.LIBCRYPTO-1_1(?,00007FFB0BC482EC), ref: 00007FFB0BC4C7EB

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: T_free$P_resp_count$E_freeL_sk_new_nullP_freeP_get1_ext_d2iP_resp_get0P_response_get1_basicR_put_errorX509_get_ext_d2id2i_
String ID:
API String ID: 2393059476-0
Opcode ID: 76fd3bcacf334f1c2470ec69d84b8f21cf506a49e8396b11a5fe56694b7effb4
Instruction ID: a822ade8bad2a3ddb1e1fbd2d16c5a4da95b4ad3b71929cb52086d18abd14145
Opcode Fuzzy Hash: 76fd3bcacf334f1c2470ec69d84b8f21cf506a49e8396b11a5fe56694b7effb4
Instruction Fuzzy Hash: 7C41A091B09B4762EE789AB6D051BBA6290DF44B80F048034DE4F87FE2DF6DE5408700

Function 61CD2660 Relevance: 18.1, APIs: 12, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 61CD2681
HeapAlloc.KERNEL32 ref: 61CD2696
memcpy.MSVCRT ref: 61CD270C
GetProcessHeap.KERNEL32 ref: 61CD272A
HeapFree.KERNEL32 ref: 61CD2735
GetProcessHeap.KERNEL32 ref: 61CD274A
HeapFree.KERNEL32 ref: 61CD2755
GetProcessHeap.KERNEL32 ref: 61CD2770
HeapFree.KERNEL32 ref: 61CD277B
GetProcessHeap.KERNEL32 ref: 61CD2785
HeapAlloc.KERNEL32 ref: 61CD2790
GetAdaptersAddresses.IPHLPAPI ref: 61CD27AC

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Heap$Process$Free$Alloc$AdaptersAddressesmemcpy
String ID:
API String ID: 1739390247-0
Opcode ID: f94046b673e90456833a2c6b0b51a98eb54aac873b12c4fef50b8f4abfc44559
Instruction ID: 8f7451ac445a9fee388f9fa0f64ee5a43c27756b6e9bc6aef873cc50c0020706
Opcode Fuzzy Hash: f94046b673e90456833a2c6b0b51a98eb54aac873b12c4fef50b8f4abfc44559
Instruction Fuzzy Hash: FB31E7227016419AEB55DFBAA850BAE6792AB89BD4F4CC135EF1C47718FF38C582C700

Function 61D407F0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 283memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,61CC1278), ref: 61D4091D

Strings

Unknown pseudo relocation protocol version %d., xrefs: 61D40A9E
Unknown pseudo relocation bit size %d., xrefs: 61D40A8A

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: a264bdf7196f54d9f9dcf3f5f7f68f46268d3144cc707cd2af501bcdc4cd9669
Instruction ID: c7cec2f3225e14f290216b143f16967aab57fd3694b8c1ac251b3c72ff913722
Opcode Fuzzy Hash: a264bdf7196f54d9f9dcf3f5f7f68f46268d3144cc707cd2af501bcdc4cd9669
Instruction Fuzzy Hash: 6D916531B1024186FB108BB5C9807CE77A2BBA97E8F58C515CE99C7BA4EB3DD0928741

Function 61CD4620 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 117stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 61CD463A
malloc.MSVCRT ref: 61CD4646
memcpy.MSVCRT ref: 61CD4665
strchr.MSVCRT ref: 61CD4744
free.MSVCRT ref: 61CD4776

Strings

local, xrefs: 61CD46B3
http://, xrefs: 61CD46D1
or,, xrefs: 61CD467A
and,, xrefs: 61CD4673

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: freemallocmemcpystrchrstrlen
String ID: and,$http://$local$or,
API String ID: 3771145599-2506292620
Opcode ID: 29f58867a350d69b995ed17f2467fb20027537f641024853693f2d1bf77cabfc
Instruction ID: 6fc9e80909a871a0d05d91f6194abb6954bdcc42c5f85b0f82c43a015ac90e8d
Opcode Fuzzy Hash: 29f58867a350d69b995ed17f2467fb20027537f641024853693f2d1bf77cabfc
Instruction Fuzzy Hash: 9931B625B06698D1FA118B92A90036E2B91A742BF8F8AC7158F3817FD4FB3AD057C311

Function 61CCA205 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CCA216
PyList_New.PYTHON310 ref: 61CCAB30

Strings

NULL object in marshal data for list, xrefs: 61CCB635
bad marshal data (list size out of range), xrefs: 61CCAF48

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_List_Occurred
String ID: NULL object in marshal data for list$bad marshal data (list size out of range)
API String ID: 1902535023-3453879413
Opcode ID: a87cce3945d53ceaaec59dfc901a9f23f182f20f425b29dff9572d6452ab331e
Instruction ID: 74d973b6c82713e991628c19c8cc0a34d2771ee9677d25c4354e1f793238afee
Opcode Fuzzy Hash: a87cce3945d53ceaaec59dfc901a9f23f182f20f425b29dff9572d6452ab331e
Instruction Fuzzy Hash: B0313A71246B51C2EA158BAAE49475E33A6BB85F84F09C425CD0E07724FF39C899C742

Function 00007FFB0BC36C12 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB0BC36C34
EVP_PKEY_new.LIBCRYPTO-1_1 ref: 00007FFB0BC36C4B
EVP_PKEY_set1_DH.LIBCRYPTO-1_1 ref: 00007FFB0BC36C59
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB0BC36C65
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB0BC36C8C

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFB0BC36C2A, 00007FFB0BC36C7E, 00007FFB0BC36CC7

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: R_put_error$Y_freeY_newY_set1_
String ID: ..\s\ssl\s3_lib.c
API String ID: 520254984-4238427508
Opcode ID: bd464dee4de3cd23d81958046336a0d1af79ae9319f2322e60d4872f49853e5c
Instruction ID: 3d457c015fc283646dee5d4b26d3bd92568462990d5af5c3c618900501d21c3f
Opcode Fuzzy Hash: bd464dee4de3cd23d81958046336a0d1af79ae9319f2322e60d4872f49853e5c
Instruction Fuzzy Hash: 0D2157A1B1C552A2F720DB35F400AAD6390FB88B84F444531DE8D87FA5DF3DE5528B04

Function 61CCA370 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CCA381
PyTuple_New.PYTHON310 ref: 61CCAA02

Strings

bad marshal data (tuple size out of range), xrefs: 61CCB224
NULL object in marshal data for tuple, xrefs: 61CCB463

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_OccurredTuple_
String ID: NULL object in marshal data for tuple$bad marshal data (tuple size out of range)
API String ID: 3674511531-3094253248
Opcode ID: 71e0c9737f81c3565dff363f523eb30309285aa33aca99aae29edf52d1e2107b
Instruction ID: 784ea46ce305314ad18014f5c9bc7b5c95d934dbf37fa88597c88c19386e91ff
Opcode Fuzzy Hash: 71e0c9737f81c3565dff363f523eb30309285aa33aca99aae29edf52d1e2107b
Instruction Fuzzy Hash: C5212E71346B51C6EA14CBA9D58875E33A6BB89F85F1AC514CD0E47324FF39C898C781

Function 61CC94D0 Relevance: 16.8, APIs: 11, Instructions: 338fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61CC9801

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: fwrite
String ID:
API String ID: 3559309478-0
Opcode ID: 5e1dc6febd64f9042e72d36431d433e36e5d46976fd542005d9f4f35b91988ae
Instruction ID: 8457e8d77e75f0d1439d7db817747e8abad2759086f5dec60a058f97d5f2d0b3
Opcode Fuzzy Hash: 5e1dc6febd64f9042e72d36431d433e36e5d46976fd542005d9f4f35b91988ae
Instruction Fuzzy Hash: CAC155B6211B84C5DB15CFAAE44478D37A4F319FECF648216DE6D1B388EA38C995C381

Function 61CDDED0 Relevance: 16.6, APIs: 8, Strings: 3, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61CDDEFB
strcmp.MSVCRT ref: 61CDDF25
strcmp.MSVCRT ref: 61CDDF44
strcmp.MSVCRT ref: 61CDDF63
strcmp.MSVCRT ref: 61CDDF82
strcmp.MSVCRT ref: 61CDDF9D
strcmp.MSVCRT ref: 61CDDFB8
strcmp.MSVCRT ref: 61CDDFD3

Strings

src/misc/crypt/crypt_find_hash.c, xrefs: 61CDE001
aes, xrefs: 61CDDED3
name != NULL, xrefs: 61CDE008

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: strcmp
String ID: aes$name != NULL$src/misc/crypt/crypt_find_hash.c
API String ID: 1004003707-455514378
Opcode ID: 4513fc7f914963b0cbd3d208ec4f68ddf40bdcc3dfb417b920b8adcec4295e37
Instruction ID: 9dab4774c7fc1ddc2c46e81ef651dc0aa889c6b9d792af6abe436f1d3d02c141
Opcode Fuzzy Hash: 4513fc7f914963b0cbd3d208ec4f68ddf40bdcc3dfb417b920b8adcec4295e37
Instruction Fuzzy Hash: F1314331B0268689FF25DAA696D47FE6765EF84BC8F01C150DF2A8B984FF24D10AC711

Function 61CCA3A0 Relevance: 16.6, APIs: 11, Instructions: 84COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON310 ref: 61CCA3A0
PyList_Append.PYTHON310 ref: 61CCA7B1
PyDict_SetItem.PYTHON310 ref: 61CCA807
_Py_Dealloc.PYTHON310 ref: 61CCA82C
_Py_Dealloc.PYTHON310 ref: 61CCA836
_Py_Dealloc.PYTHON310 ref: 61CCA84F
_Py_Dealloc.PYTHON310 ref: 61CCA85E
PyErr_Occurred.PYTHON310 ref: 61CCA864
_Py_Dealloc.PYTHON310 ref: 61CCA885

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Dealloc$Dict_$AppendErr_ItemList_Occurred
String ID:
API String ID: 30499974-0
Opcode ID: 4fe2ec7ce7adf009189f148be903c58141f0356158a6167416c93571fe15460d
Instruction ID: d7d1053d46f04b682dcc22fd5902d86f3d17e71541cebdc1e7731b1a8ef527fd
Opcode Fuzzy Hash: 4fe2ec7ce7adf009189f148be903c58141f0356158a6167416c93571fe15460d
Instruction Fuzzy Hash: C2311A31646B40D6EA599FA6E91835E33B5B78AF98F0CC424CE4E46724FE3DC851C342

Function 61CD2DE0 Relevance: 16.6, APIs: 11, Instructions: 78memorynetworkCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 61CD2DFB
HeapAlloc.KERNEL32 ref: 61CD2E0F
GetNetworkParams.IPHLPAPI ref: 61CD2E47
GetProcessHeap.KERNEL32 ref: 61CD2E69
HeapFree.KERNEL32 ref: 61CD2E73
GetProcessHeap.KERNEL32 ref: 61CD2E90
HeapFree.KERNEL32 ref: 61CD2E9A
GetProcessHeap.KERNEL32 ref: 61CD2EA1
HeapAlloc.KERNEL32 ref: 61CD2EAB
GetProcessHeap.KERNEL32 ref: 61CD2EC6
HeapFree.KERNEL32 ref: 61CD2ED0

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Heap$Process$Free$Alloc$NetworkParams
String ID:
API String ID: 3483679945-0
Opcode ID: 2ef620387ae84fae21d26180c3c15083aadb5e446257ce9ca419757b2d01634b
Instruction ID: 85d0d4f7944e3a35530cd778f185fd4eefcb396b4eb1210a9cf47539c82dc765
Opcode Fuzzy Hash: 2ef620387ae84fae21d26180c3c15083aadb5e446257ce9ca419757b2d01634b
Instruction Fuzzy Hash: 1611D31270160694EA14E7B77C107AE96926BCABD9F49C136AE2C977A4FF38C002C350

Function 61CC1660 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON310 ref: 61CC16ED
PyErr_Occurred.PYTHON310 ref: 61CC178E

Strings

%s (%d:%d), xrefs: 61CC16DB

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$FormatOccurred
String ID: %s (%d:%d)
API String ID: 4038069558-1595188566
Opcode ID: f9610f2a25ef7a59d03c785dbc32e3411bb60fa61ebe9aa1fe774c1f4d94c1b2
Instruction ID: 5922db436765376da80ba3c8fa6ec99c5cc121135d1323adbceffb0ae6774fd5
Opcode Fuzzy Hash: f9610f2a25ef7a59d03c785dbc32e3411bb60fa61ebe9aa1fe774c1f4d94c1b2
Instruction Fuzzy Hash: 3341B172615780C6EB048BAFA4513AE7B71F786FD8F4D8025CE4E07B24EE29C942C741

Function 61D40D40 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 61D40D99
signal.MSVCRT ref: 61D40DF2
signal.MSVCRT ref: 61D40E4E
signal.MSVCRT ref: 61D40F03

Strings

CCG , xrefs: 61D40D55

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 99e9f4763ba3245d04afdfd965b8f3068407ec19efe5095d6deb2f451f5baa97
Instruction ID: 0e6b50e8f1e7ad68c1b26515caa482bc998f57ec2cd29009131d19cb1f668d48
Opcode Fuzzy Hash: 99e9f4763ba3245d04afdfd965b8f3068407ec19efe5095d6deb2f451f5baa97
Instruction Fuzzy Hash: 9131702070550586FA3543F944503E914629BEE3F8F1CCA39CAB9C73E5DF5D98F50222

Function 61CC9E20 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CC9E30
PyUnicode_DecodeUTF8.PYTHON310 ref: 61CCA6FF

Strings

bad marshal data (string size out of range), xrefs: 61CCAEC5
surrogatepass, xrefs: 61CCA6F5

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: DecodeErr_OccurredUnicode_
String ID: bad marshal data (string size out of range)$surrogatepass
API String ID: 1138423624-4021928140
Opcode ID: cfc3595712a3e096a524b85f8e51fede40032b7c15b336b64b3dc7db1e4364e0
Instruction ID: b1f7c7e69a6263a6538a3478a02633f2ad3c7674fbe5c8b92e55900d957f3f71
Opcode Fuzzy Hash: cfc3595712a3e096a524b85f8e51fede40032b7c15b336b64b3dc7db1e4364e0
Instruction Fuzzy Hash: 9731B432246654C6EA15CF5AE44879E73A6FB95F95F0AC524CE0E07314FF38D88AC781

Function 61CC7FC0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 65stringCOMMON

Download Yara Rule

APIs

PyErr_SetFromWindowsErr.PYTHON310 ref: 61CC7FEE
PyErr_Fetch.PYTHON310 ref: 61CC8003
PyErr_Restore.PYTHON310 ref: 61CC8018
PyObject_Str.PYTHON310 ref: 61CC8028
strerror.MSVCRT ref: 61CC8035
PyErr_Format.PYTHON310 ref: 61CC8071

Strings

%s (%d:%d), xrefs: 61CC8064

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$FetchFormatFromObject_RestoreWindowsstrerror
String ID: %s (%d:%d)
API String ID: 2858978339-1595188566
Opcode ID: 986e9425b6669b90e83ec099073c66fd55e6c6553391f986e69974411f2f7ed9
Instruction ID: 5217c873a75199fcbf04a77795d7ed3c7157475a3a7423297fcc6a547475c8ca
Opcode Fuzzy Hash: 986e9425b6669b90e83ec099073c66fd55e6c6553391f986e69974411f2f7ed9
Instruction Fuzzy Hash: F421B072605B44C2EB008B69E8907DE7761FBCAF84F898026CE4E13364DE3EC846C381

Function 61CCF490 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 58fileCOMMON

Download Yara Rule

APIs

PyList_New.PYTHON310 ref: 61CCF4CB
PyErr_Occurred.PYTHON310 ref: 61CCF4EA
PyMem_Free.PYTHON310 ref: 61CCF518
fwrite.MSVCRT ref: 61CCF562
PyErr_Occurred.PYTHON310 ref: 61CCF570
PyErr_SetString.PYTHON310 ref: 61CCF588

Strings

NULL object in marshal data for object, xrefs: 61CCF57E
XXX readobject called with exception set, xrefs: 61CCF54D

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$Occurred$FreeList_Mem_Stringfwrite
String ID: NULL object in marshal data for object$XXX readobject called with exception set
API String ID: 4281374468-3392712392
Opcode ID: dc6df9b40210079467497c110de4b1396907f1b0b2f936bc6119ed9524df5a46
Instruction ID: 7a2e8630803e4e962a94717a91c01f94859623866d17cb356d8c18b4c6caff74
Opcode Fuzzy Hash: dc6df9b40210079467497c110de4b1396907f1b0b2f936bc6119ed9524df5a46
Instruction Fuzzy Hash: 7A219031205B40CAEB048FA5F84475E77A1FB95F88F188025DA8E47764EF3DC856C741

Function 61CCF3A0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

PyList_New.PYTHON310 ref: 61CCF3C3
PyErr_Occurred.PYTHON310 ref: 61CCF3DD
PyMem_Free.PYTHON310 ref: 61CCF40B
fwrite.MSVCRT ref: 61CCF452
PyErr_Occurred.PYTHON310 ref: 61CCF460
PyErr_SetString.PYTHON310 ref: 61CCF478

Strings

NULL object in marshal data for object, xrefs: 61CCF46E
XXX readobject called with exception set, xrefs: 61CCF43D

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$Occurred$FreeList_Mem_Stringfwrite
String ID: NULL object in marshal data for object$XXX readobject called with exception set
API String ID: 4281374468-3392712392
Opcode ID: 8d57ed226082482c3a2c1aeb7c31c0b4a1fae592a559b3213bae24a64d24d32e
Instruction ID: b2b33b74236ffb2b8679ad53ec696ff2de2faa6f5c1e1399e8f2f2c9b21ea9ae
Opcode Fuzzy Hash: 8d57ed226082482c3a2c1aeb7c31c0b4a1fae592a559b3213bae24a64d24d32e
Instruction Fuzzy Hash: 60118B31206A40D9FA059BA9F8447AE67B0FB89F88F1C8125DE4D42324FF3EC896C741

Function 61CCF080 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON310 ref: 61CCF08F
fread.MSVCRT ref: 61CCF0B2
PyMem_Free.PYTHON310 ref: 61CCF0D2
PyErr_Occurred.PYTHON310 ref: 61CCF0E2
PyErr_Format.PYTHON310 ref: 61CCF112
PyErr_NoMemory.PYTHON310 ref: 61CCF140

Strings

read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61CCF108
EOF read where not expected, xrefs: 61CCF127

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$Mem_$FormatFreeMallocMemoryOccurredfread
String ID: EOF read where not expected$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 28673812-3742967138
Opcode ID: f5565295976b8d0e9911378bb928282a3e7fa7f9ff04086d046c3fae7b5c9962
Instruction ID: ee696c1bbcf004c79bf2d6fe273efb4044477f8fb24a50038606dc243b3f587b
Opcode Fuzzy Hash: f5565295976b8d0e9911378bb928282a3e7fa7f9ff04086d046c3fae7b5c9962
Instruction Fuzzy Hash: 9D110430705A40C9EB144BFAEC947992362B789FD9F0C8221CD5D433A4EE2E8959C352

Function 61CCF150 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON310 ref: 61CCF15F
fread.MSVCRT ref: 61CCF182
PyMem_Free.PYTHON310 ref: 61CCF195
PyErr_Occurred.PYTHON310 ref: 61CCF1A5
PyErr_Format.PYTHON310 ref: 61CCF1D5
PyErr_NoMemory.PYTHON310 ref: 61CCF200

Strings

read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61CCF1CB
EOF read where not expected, xrefs: 61CCF1E7

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$Mem_$FormatFreeMallocMemoryOccurredfread
String ID: EOF read where not expected$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 28673812-3742967138
Opcode ID: b686c1d27bde5cab8e1aeb4dc128f4ba9875edd9f7e429db6371fc7f12f23ca9
Instruction ID: 7cc2239c7b38a7b75990796eb19132900b62758753b2f3d5eebbc1df96f49c75
Opcode Fuzzy Hash: b686c1d27bde5cab8e1aeb4dc128f4ba9875edd9f7e429db6371fc7f12f23ca9
Instruction Fuzzy Hash: EE119231701540C6FA049BEAEC407892322A78AFE8F0C8225CD1D073E4EE3E8D55C381

Function 61CDFB70 Relevance: 15.5, APIs: 2, Strings: 8, Instructions: 455COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 61CDFC13
free.MSVCRT ref: 61CDFCC1

Strings

ltc_mp.name != NULL, xrefs: 61CE01FC
ltc_mp.name != NULL, xrefs: 61CDFFC1
key != NULL, xrefs: 61CDFFDA
in != NULL, xrefs: 61CDFFF3
key != NULL, xrefs: 61CE01E3
size > 0, xrefs: 61CE0215
src/pk/rsa/rsa_make_key.c, xrefs: 61CE01DC, 61CE01F5, 61CE020E
src/pk/rsa/rsa_import.c, xrefs: 61CDFFBA, 61CDFFD3, 61CDFFEC

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: callocfree
String ID: in != NULL$key != NULL$key != NULL$ltc_mp.name != NULL$ltc_mp.name != NULL$size > 0$src/pk/rsa/rsa_import.c$src/pk/rsa/rsa_make_key.c
API String ID: 306872129-2031961738
Opcode ID: c0a3150551e138589425c658f5d8db749d264fa9f7b805cfee66ecb5cd0106df
Instruction ID: 0151bc3ec68a4d056710fef589804edc2c38616b4d6783f1eabc269235cc0161
Opcode Fuzzy Hash: c0a3150551e138589425c658f5d8db749d264fa9f7b805cfee66ecb5cd0106df
Instruction Fuzzy Hash: 8B120A72208B81C6E7608F66E44479EB7B4F785BC8F148116EF8987B58EF79C495CB80

Function 61CDE350 Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 177COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61CDE383
memcmp.MSVCRT ref: 61CDE3A3
memcmp.MSVCRT ref: 61CDE3C5
memcmp.MSVCRT ref: 61CDE3E5
memcmp.MSVCRT ref: 61CDE405
memcmp.MSVCRT ref: 61CDE425
memcmp.MSVCRT ref: 61CDE445
memcmp.MSVCRT ref: 61CDE465

Strings

hash != NULL, xrefs: 61CDE5BE
src/misc/crypt/crypt_register_hash.c, xrefs: 61CDE5B7

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: memcmp
String ID: hash != NULL$src/misc/crypt/crypt_register_hash.c
API String ID: 1475443563-1465673959
Opcode ID: d2ceb6592125d6edbe34748161da828b04d998744f7ca786a42611a48647974a
Instruction ID: 299f8286cc3b1fbab02f13aeb4ef8e37453e7965f2bd8d91847e6b1636a7153d
Opcode Fuzzy Hash: d2ceb6592125d6edbe34748161da828b04d998744f7ca786a42611a48647974a
Instruction Fuzzy Hash: 2B619C72701B4486E750CB66E884B9EB7A8F744BC8F418125CF9987B50FF39E19AC350

Function 61CDE5E0 Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61CDE613
memcmp.MSVCRT ref: 61CDE630
memcmp.MSVCRT ref: 61CDE652
memcmp.MSVCRT ref: 61CDE672
memcmp.MSVCRT ref: 61CDE692
memcmp.MSVCRT ref: 61CDE6B2
memcmp.MSVCRT ref: 61CDE6D2
memcmp.MSVCRT ref: 61CDE6F2

Strings

src/misc/crypt/crypt_register_prng.c, xrefs: 61CDE80F
prng != NULL, xrefs: 61CDE816

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: memcmp
String ID: prng != NULL$src/misc/crypt/crypt_register_prng.c
API String ID: 1475443563-58737364
Opcode ID: 51f73355685b8cdd7501c1315a9cda5064aed90e240e2d9bc6618430435fcd6d
Instruction ID: a86ad49dae76f4c3a739ebdc7036aac9fd4de47bca1c99acaac826aa483977a1
Opcode Fuzzy Hash: 51f73355685b8cdd7501c1315a9cda5064aed90e240e2d9bc6618430435fcd6d
Instruction Fuzzy Hash: CA516E32710B9596E790CF52D9C8B9FBBA8FB48BC4F468025CF2983640EB34E159C711

Function 61CDE020 Relevance: 15.1, APIs: 8, Strings: 2, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61CDE04B
strcmp.MSVCRT ref: 61CDE06F
strcmp.MSVCRT ref: 61CDE08B
strcmp.MSVCRT ref: 61CDE0AA
strcmp.MSVCRT ref: 61CDE0C9
strcmp.MSVCRT ref: 61CDE0E4
strcmp.MSVCRT ref: 61CDE0FF
strcmp.MSVCRT ref: 61CDE11A

Strings

name != NULL, xrefs: 61CDE14F
src/misc/crypt/crypt_find_prng.c, xrefs: 61CDE148

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: strcmp
String ID: name != NULL$src/misc/crypt/crypt_find_prng.c
API String ID: 1004003707-2030105502
Opcode ID: cc53707e9c0a7693929d3ae0d03d1013efb609465a4567c9a0196d7a117ec9c5
Instruction ID: 6956a928aa1e8bd94b76c4cc5e940ac7dd490f7976a9855fe8bdba52e17ed856
Opcode Fuzzy Hash: cc53707e9c0a7693929d3ae0d03d1013efb609465a4567c9a0196d7a117ec9c5
Instruction Fuzzy Hash: 88314031702546C9FF159AA39AD47FEA766AB45BC8F408120CF2A8B945FB24E107D320

Function 61CDDD80 Relevance: 15.1, APIs: 8, Strings: 2, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61CDDDAB
strcmp.MSVCRT ref: 61CDDDD5
strcmp.MSVCRT ref: 61CDDDF4
strcmp.MSVCRT ref: 61CDDE13
strcmp.MSVCRT ref: 61CDDE32
strcmp.MSVCRT ref: 61CDDE4D
strcmp.MSVCRT ref: 61CDDE68
strcmp.MSVCRT ref: 61CDDE83

Strings

name != NULL, xrefs: 61CDDEB8
src/misc/crypt/crypt_find_cipher.c, xrefs: 61CDDEB1

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: strcmp
String ID: name != NULL$src/misc/crypt/crypt_find_cipher.c
API String ID: 1004003707-679692990
Opcode ID: cd8908598153d0c7e152046bf9a905de07450af512f64240ef1d2a504e1d9607
Instruction ID: 7a347d85db833161780adca2f769910e31a9449ee968256a2ea78c0337d2da7e
Opcode Fuzzy Hash: cd8908598153d0c7e152046bf9a905de07450af512f64240ef1d2a504e1d9607
Instruction Fuzzy Hash: E6312121B0268789FF15DA929AD47FE6765EF91BC8F01C1508F2A8BD84FB24D506C710

Function 61CC13C0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

PySys_GetObject.PYTHON310 ref: 61CC158B
PyUnicode_AsUTF8AndSize.PYTHON310 ref: 61CC159B
getenv.MSVCRT ref: 61CC15BB

Strings

_PARLANG, xrefs: 61CC1584, 61CC162C
LANG, xrefs: 61CC15B4
PYARMOR_LANG, xrefs: 61CC1565

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: ObjectSizeSys_Unicode_getenv
String ID: LANG$PYARMOR_LANG$_PARLANG
API String ID: 223123148-1822377752
Opcode ID: 084834abde023e610e8cd6031b6826ba0d715a3312432c0e1c3af8454c7595a5
Instruction ID: fc36031750c0e90e8f8e9085fbe6f4de4f2eba3975ff6abdacda3efa3ef88458
Opcode Fuzzy Hash: 084834abde023e610e8cd6031b6826ba0d715a3312432c0e1c3af8454c7595a5
Instruction Fuzzy Hash: DB51C0B26092E0C5EB02CBAF91903ADBFB3A742F85F4DC016CA9947355E729C895C352

Function 61CD9020 Relevance: 13.9, APIs: 3, Strings: 6, Instructions: 356stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 61CD91E6

Strings

src/hashes/md5.c, xrefs: 61CD9137, 61CD9150
MD5, xrefs: 61CD9277
@, xrefs: 61CD919D
8, xrefs: 61CD9519
in != NULL, xrefs: 61CD9157
md != NULL, xrefs: 61CD913E

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: strlen
String ID: 8$@$MD5$in != NULL$md != NULL$src/hashes/md5.c
API String ID: 39653677-1219784974
Opcode ID: 951779170d8a5b9b30fa3bf48e0d66b6c572d7ac9aa812464d02b1f4f448ba23
Instruction ID: a58da727a0480f5cbc62a21c7d68b21cbacb829f8dc12bed4bab6d2edc394db9
Opcode Fuzzy Hash: 951779170d8a5b9b30fa3bf48e0d66b6c572d7ac9aa812464d02b1f4f448ba23
Instruction Fuzzy Hash: 3CD1F1B7A082C1CAF705CB9AE46476EBFA0E392388F449119CF820BB45F779D445CB42

Function 61CE8240 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 61CE82B3
malloc.MSVCRT ref: 61CE82BD

Strings

mask != NULL, xrefs: 61CE8489
seed != NULL, xrefs: 61CE8470
src/pk/pkcs1/pkcs_1_mgf1.c, xrefs: 61CE8469, 61CE8482

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: malloc
String ID: mask != NULL$seed != NULL$src/pk/pkcs1/pkcs_1_mgf1.c
API String ID: 2803490479-2931318352
Opcode ID: 424f0cd2d71e7f237aeab08e1849e8302eb8ef1ecc1ab36f7dfef96e60b5a402
Instruction ID: 456cb0b97573ba8b77dcdfc2e184205ecb6c07c4da1ee35fe17198277bb671d4
Opcode Fuzzy Hash: 424f0cd2d71e7f237aeab08e1849e8302eb8ef1ecc1ab36f7dfef96e60b5a402
Instruction Fuzzy Hash: F2513432758281CAEB02CF659918B7E7FA1EB41B88F49C018CE6647A45FB39D115EB10

Function 00007FFB0BC78C40 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 135COMMON

Download Yara Rule

Strings

No ciphers enabled for max supported SSL/TLS version, xrefs: 00007FFB0BC78DE5
n, xrefs: 00007FFB0BC78CC1
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFB0BC78CC9, 00007FFB0BC78DB8

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: O_new
String ID: ..\s\ssl\statem\statem_lib.c$No ciphers enabled for max supported SSL/TLS version$n
API String ID: 458078758-706774904
Opcode ID: 157325870e04d7ae13f5d959090b7e94d71faf3629bff73161b6ccd23dfb00d1
Instruction ID: 7e8baedc31210601b70bd91313c4f4b9afabe868cc0380b081886c8324c467cb
Opcode Fuzzy Hash: 157325870e04d7ae13f5d959090b7e94d71faf3629bff73161b6ccd23dfb00d1
Instruction Fuzzy Hash: 42515CB2A0868295E7A08F26D444BBD37A0FB85B84F58C135DE8E97BA5CF3CD485C750

Function 00007FFB0BA31180 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON310 ref: 00007FFB0BA311D4
PyBytes_FromStringAndSize.PYTHON310 ref: 00007FFB0BA311F4
PyErr_SetString.PYTHON310 ref: 00007FFB0BA31213
memmove.VCRUNTIME140 ref: 00007FFB0BA31274
memmove.VCRUNTIME140 ref: 00007FFB0BA312A3
_Py_Dealloc.PYTHON310 ref: 00007FFB0BA312CC

Strings

Unable to allocate output buffer., xrefs: 00007FFB0BA31209

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: DeallocStringmemmove$Bytes_Err_FromSize
String ID: Unable to allocate output buffer.
API String ID: 1583460924-2565006440
Opcode ID: 302ccff948575bc5b6c0570f94851fca6a0315b5f66909de60de6dc7c0aacbcc
Instruction ID: 0641fd7fc4d785a5c8db843a601e5f583f37353d75882602fe72a10eef56a4a5
Opcode Fuzzy Hash: 302ccff948575bc5b6c0570f94851fca6a0315b5f66909de60de6dc7c0aacbcc
Instruction Fuzzy Hash: 0A416BB7A08B4582EB159F66E4406A9B7A0FB58FE4F488436DE4E83764CF3CD595C300

Function 61CC9E90 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

PyUnicode_FromKindAndData.PYTHON310 ref: 61CC9ED6
PyErr_SetString.PYTHON310 ref: 61CCA927

Strings

EOF read where object expected, xrefs: 61CCA91A

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: DataErr_FromKindStringUnicode_
String ID: EOF read where object expected
API String ID: 3898585613-3634523442
Opcode ID: c0dfd882597c459ca2c45ccd648d82792411e9ee5c2719ce2377cce0c49b3903
Instruction ID: 7a8d1219fab3fcf4e63fd980eb9c21017ff4bc329c4e9ab1c17991e23e95a47e
Opcode Fuzzy Hash: c0dfd882597c459ca2c45ccd648d82792411e9ee5c2719ce2377cce0c49b3903
Instruction Fuzzy Hash: 71319E72245690C2EA11CB59D488B9E33A6FB95F95F0AC514CE4E07764FF38DC85C782

Function 61CC8C40 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 61CC8C99
PyOS_string_to_double.PYTHON310 ref: 61CC8CAB
PyErr_SetString.PYTHON310 ref: 61CC8D03

Strings

marshal data too short, xrefs: 61CC8D4C
EOF read where object expected, xrefs: 61CC8CF9

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_S_string_to_doubleStringmemcpy
String ID: EOF read where object expected$marshal data too short
API String ID: 1651926552-3827827332
Opcode ID: 2464580acd458d5753a468efcbbe4a21debe9c40ffff299863aba6a85a0b94ac
Instruction ID: c51cd361922d3c50bd81649438d5a6ebe32f6113eac8ae8ea8c9f471fa468775
Opcode Fuzzy Hash: 2464580acd458d5753a468efcbbe4a21debe9c40ffff299863aba6a85a0b94ac
Instruction Fuzzy Hash: 6A315072606A14C4EF159F69E4507AE3361B745FC8F5886228E0D07358EF39C9A6E382

Function 00007FFB0BC21C7B Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-1_1 ref: 00007FFB0BC507FF
BIO_new.LIBCRYPTO-1_1 ref: 00007FFB0BC50807
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB0BC50834
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB0BC508CD
BIO_free.LIBCRYPTO-1_1 ref: 00007FFB0BC508D5

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFB0BC508BC

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: O_ctrlO_freeO_newO_s_fileR_put_error
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 2618924202-2723262194
Opcode ID: d9b458d87d1dcdf048473b1e37ef7f024ece06dd3e70e12fcda0ab5187114a4e
Instruction ID: 5eb80abf881529ed4d056e9678530a404dbe64d619a10fa82ae9c3cab0596f8f
Opcode Fuzzy Hash: d9b458d87d1dcdf048473b1e37ef7f024ece06dd3e70e12fcda0ab5187114a4e
Instruction Fuzzy Hash: 873171A1A0C742A6F6349B22D500EBA6351FB45B84F148035EE8FDBFA6DF3CE5418740

Function 00007FFB0BA31070 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 00007FFB0BA310D1
PyBytes_FromStringAndSize.PYTHON310 ref: 00007FFB0BA310EB
PyErr_SetString.PYTHON310 ref: 00007FFB0BA3110A
PyList_Append.PYTHON310 ref: 00007FFB0BA3111B
_Py_Dealloc.PYTHON310 ref: 00007FFB0BA31136

Strings

Unable to allocate output buffer., xrefs: 00007FFB0BA310C7, 00007FFB0BA31100

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: String$Err_$AppendBytes_DeallocFromList_Size
String ID: Unable to allocate output buffer.
API String ID: 2547554596-2565006440
Opcode ID: 7e1e3b8c1928b2da807ddf7aa8ca177fec8d15fc26be477a22987a1ae2f2f214
Instruction ID: 9387b7f3ca7d6cf74785395f2aecf48071fd057cc085986e6210871e472177bb
Opcode Fuzzy Hash: 7e1e3b8c1928b2da807ddf7aa8ca177fec8d15fc26be477a22987a1ae2f2f214
Instruction Fuzzy Hash: BB313C62B19B4291EA11CB25E85097973A4FB55FA4B548232EE6F93BB4DF3DE4448300

Function 61CC8F60 Relevance: 12.2, APIs: 8, Instructions: 242fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61CC900D

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: fwrite
String ID:
API String ID: 3559309478-0
Opcode ID: 008ce2509c13a5ab9b6920b27a6fc40c9acce8c9e7eac2d2739917e958a3a980
Instruction ID: de9ef5dd44cdd0db2dc3a10afdb5792d1cffec1feab7e23b777b447c855c55ac
Opcode Fuzzy Hash: 008ce2509c13a5ab9b6920b27a6fc40c9acce8c9e7eac2d2739917e958a3a980
Instruction Fuzzy Hash: 059178B2201B80C5DB148FAAD54079E77A1F749FE8F548216DF6D17398EB38C9A5C381

Function 61CC9A80 Relevance: 12.2, APIs: 8, Instructions: 169filestringCOMMON

Download Yara Rule

APIs

PyOS_double_to_string.PYTHON310 ref: 61CC9AA6
strlen.MSVCRT ref: 61CC9AB7
fwrite.MSVCRT ref: 61CC9B4B
fwrite.MSVCRT ref: 61CC9B66

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: fwrite$S_double_to_stringstrlen
String ID:
API String ID: 4243900985-0
Opcode ID: ecbd26a3e9798ba1015ee492ec2b0414e346e34950d56f649ccebdd5c5e8a869
Instruction ID: 1e01fda9b0bc870917f58c908cf957d806abc955f6c6f5811d58bc86484e8c75
Opcode Fuzzy Hash: ecbd26a3e9798ba1015ee492ec2b0414e346e34950d56f649ccebdd5c5e8a869
Instruction Fuzzy Hash: 8F5157B6301B44C5DB05CF6AE55439A37A1F748FE8F588226CE1E07798EB38C9A5C381

Function 00007FFB0BC21C3A Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

ERR_peek_error.LIBCRYPTO-1_1 ref: 00007FFB0BC48843

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: R_peek_error
String ID:
API String ID: 3623038435-0
Opcode ID: 0567de2ce4e0dd17345ebb43f0f769471d0af108d9aa9bfeb788f01831d6215d
Instruction ID: aa5620696d1af9f2b5560de4cc27559758fc30672fe247d058f9be3e33e74f1f
Opcode Fuzzy Hash: 0567de2ce4e0dd17345ebb43f0f769471d0af108d9aa9bfeb788f01831d6215d
Instruction Fuzzy Hash: 524161A2E18542A2FB789621C251B391291EF95B90F189030EE4FD7B99DF1CEA91C710

Function 61CE28D0 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 61CE2941
free.MSVCRT ref: 61CE2A3F

Strings

in != NULL, xrefs: 61CE2B02
public_key_len != NULL, xrefs: 61CE2AD0
inlen != 0, xrefs: 61CE2AE9
src/pk/asn1/der/sequence/der_decode_subject_public_key_info.c, xrefs: 61CE2AC9, 61CE2AE2, 61CE2AFB

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: callocfree
String ID: in != NULL$inlen != 0$public_key_len != NULL$src/pk/asn1/der/sequence/der_decode_subject_public_key_info.c
API String ID: 306872129-3913984646
Opcode ID: c0560e164827532662980ec12e0a83054e6251596020f6c4d742f45c44b32a39
Instruction ID: 013d3ad2bafcf9441b519c014138dddf0c5fef0ae8e63596009b5886bbf92516
Opcode Fuzzy Hash: c0560e164827532662980ec12e0a83054e6251596020f6c4d742f45c44b32a39
Instruction Fuzzy Hash: 54414A723192C2DAE730CB66E8557DEB7A1F388388F4481168A9847B48EB7DC145CB10

Function 00007FFB0BC23B30 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

BIO_get_data.LIBCRYPTO-1_1 ref: 00007FFB0BC23B7D
BIO_clear_flags.LIBCRYPTO-1_1 ref: 00007FFB0BC23B90
BIO_set_flags.LIBCRYPTO-1_1 ref: 00007FFB0BC23BD5
BIO_set_retry_reason.LIBCRYPTO-1_1 ref: 00007FFB0BC23C75

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: O_clear_flagsO_get_dataO_set_flagsO_set_retry_reason
String ID:
API String ID: 3836630899-0
Opcode ID: 0657600688c88f7dbd994915641526f6ec11eadcdc6ba18dc5d8e5d557d44d07
Instruction ID: a494322b4e6178b6baa4d773662c2373a7bc5b783636bbb3761b94804d179fb3
Opcode Fuzzy Hash: 0657600688c88f7dbd994915641526f6ec11eadcdc6ba18dc5d8e5d557d44d07
Instruction Fuzzy Hash: 3241D6B2A0825266E734AB3AE505A397251EF80BD4F10C035DE4BC7FA6CE3CE8519744

Function 00007FFB0BA31470 Relevance: 12.1, APIs: 8, Instructions: 101threadCOMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON310 ref: 00007FFB0BA314A2
PyList_New.PYTHON310 ref: 00007FFB0BA314B9
_Py_Dealloc.PYTHON310 ref: 00007FFB0BA314D9
PyEval_SaveThread.PYTHON310 ref: 00007FFB0BA3150C
PyEval_RestoreThread.PYTHON310 ref: 00007FFB0BA31549
PyEval_SaveThread.PYTHON310 ref: 00007FFB0BA31592
PyEval_RestoreThread.PYTHON310 ref: 00007FFB0BA315CF
_Py_Dealloc.PYTHON310 ref: 00007FFB0BA31609

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: Eval_Thread$DeallocRestoreSave$Bytes_FromList_SizeString
String ID:
API String ID: 2275295419-0
Opcode ID: 5933d949b30942274c393e5cfa0f89909fbd9161848d49aca86a962fd84fa288
Instruction ID: dcd53fd5142a967970506434f66c768f4a9d8ca97cef64932fa2e69b4f006d13
Opcode Fuzzy Hash: 5933d949b30942274c393e5cfa0f89909fbd9161848d49aca86a962fd84fa288
Instruction Fuzzy Hash: 1B41A572A0CB8685EB219F31E4147AAB3A0FB94B54F448136EE8E93B65EF3CD445C740

Function 00007FFB0BA78D30 Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFB0BA78DB1
memmove.VCRUNTIME140 ref: 00007FFB0BA78E5A
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB0BA78E9E
memmove.VCRUNTIME140 ref: 00007FFB0BA78EC3
memmove.VCRUNTIME140 ref: 00007FFB0BA78FD6
memmove.VCRUNTIME140 ref: 00007FFB0BA7900A
memmove.VCRUNTIME140 ref: 00007FFB0BA79027

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: memmove$exit
String ID:
API String ID: 987259897-0
Opcode ID: 896fa3ff6dc6034e01015742b7d00b17e3cd593d516e5aaf0fa330e4b8c5e894
Instruction ID: 7aebbed4e1dd7a3f01a55bab0b50aa5565934974e9be50c43c36dde7a72cedaa
Opcode Fuzzy Hash: 896fa3ff6dc6034e01015742b7d00b17e3cd593d516e5aaf0fa330e4b8c5e894
Instruction Fuzzy Hash: 04B127B6305AC08AD740CF29C8947AE7BA1E749B89F08C139CF4A4B759CF39D552CB61

Function 00007FFB0BC70BB0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

BN_bin2bn.LIBCRYPTO-1_1(?,00000000,00000000,?,..\s\ssl\statem\statem_clnt.c,00007FFB0BC6E140), ref: 00007FFB0BC70D3C
BN_bin2bn.LIBCRYPTO-1_1(?,00000000,00000000,?,..\s\ssl\statem\statem_clnt.c,00007FFB0BC6E140), ref: 00007FFB0BC70D59
BN_bin2bn.LIBCRYPTO-1_1(?,00000000,00000000,?,..\s\ssl\statem\statem_clnt.c,00007FFB0BC6E140), ref: 00007FFB0BC70D76
BN_bin2bn.LIBCRYPTO-1_1(?,00000000,00000000,?,..\s\ssl\statem\statem_clnt.c,00007FFB0BC6E140), ref: 00007FFB0BC70D8F
X509_get0_pubkey.LIBCRYPTO-1_1(?,00000000,00000000,?,..\s\ssl\statem\statem_clnt.c,00007FFB0BC6E140), ref: 00007FFB0BC70DCE

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB0BC70BBA, 00007FFB0BC70E06, 00007FFB0BC70E35

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: N_bin2bn$X509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 3650846462-1507966698
Opcode ID: fe50a2ecc3c8e04a7c1f821741a42b66c01268c629289436dbea9068b983fa2b
Instruction ID: 092704fbf89bdc6362d083af07c4690bd6ceae61c5999206ebfdc1f1df6c139b
Opcode Fuzzy Hash: fe50a2ecc3c8e04a7c1f821741a42b66c01268c629289436dbea9068b983fa2b
Instruction Fuzzy Hash: 4C61C962A29B8156E7618B35E8049AEB790FB85784F04D135FECE96B65EF3CE1908700

Function 61D405F0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 61D4069B

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 61D407C8
Address %p has no image-section, xrefs: 61D407D9
VirtualProtect failed with code 0x%x, xrefs: 61D4077A

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 1804819252-2123141913
Opcode ID: e3360d4c06574b5eea2f515d56ba30c5f06766eed3d493ec13c250ad1d72e7c1
Instruction ID: f6900d4f7ef92b9adc2eb15d78f4fbf757fd8aafeec77a1343ecbd2e1f7b0831
Opcode Fuzzy Hash: e3360d4c06574b5eea2f515d56ba30c5f06766eed3d493ec13c250ad1d72e7c1
Instruction Fuzzy Hash: E051D176711B4186EB118F65E8807DD77B2FB98BE4F18C225DE5A877A4DB38C442C740

Function 61CC9D40 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 61CC9E14

Strings

bad marshal data (unknown type code), xrefs: 61CCA517
EOF read where object expected, xrefs: 61CC9E07
recursion limit exceeded, xrefs: 61CCA53E

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_String
String ID: EOF read where object expected$bad marshal data (unknown type code)$recursion limit exceeded
API String ID: 1450464846-1585441539
Opcode ID: 97990b93ec76f01c481a29309820d77bcf3efc69b58b3c3a0d30d8f7edfb43d1
Instruction ID: a6c6e0d489ff8fdd65699c3ba8b44814556e03277ac077c74b6166bb0ea9a9fb
Opcode Fuzzy Hash: 97990b93ec76f01c481a29309820d77bcf3efc69b58b3c3a0d30d8f7edfb43d1
Instruction Fuzzy Hash: 68319E32204A84D1EB118B1DE8807ED37B1BB98B9DF459611DE4907374EF39C89AC351

Function 61D40330 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 61D40375
GetCurrentProcessId.KERNEL32 ref: 61D40380
GetCurrentThreadId.KERNEL32 ref: 61D40389
GetTickCount.KERNEL32 ref: 61D40391
QueryPerformanceCounter.KERNEL32 ref: 61D4039E

Strings

Jzkx;, xrefs: 61D4033A

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID: Jzkx;
API String ID: 1445889803-166890614
Opcode ID: e6fe8e715f36b92305f8865e5d64e7a76eb53a137695b293f4a5d4904744732b
Instruction ID: 7fe22ee49643e842c2f244a8a0361d35afe0d873d50b104639b1058eaa2a56fe
Opcode Fuzzy Hash: e6fe8e715f36b92305f8865e5d64e7a76eb53a137695b293f4a5d4904744732b
Instruction Fuzzy Hash: FE118C36655A5096FB108B65F80839A66A1B74C7B0F084670DE9D437A4EA3DC495C340

Function 61CCA231 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CCA23C
PyBytes_FromStringAndSize.PYTHON310 ref: 61CCA9A4
memcpy.MSVCRT ref: 61CCA9E1

Strings

bad marshal data (bytes object size out of range), xrefs: 61CCAF13

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Bytes_Err_FromOccurredSizeStringmemcpy
String ID: bad marshal data (bytes object size out of range)
API String ID: 2675459810-66224825
Opcode ID: 10ce5bc18453f0e0975be722a1f3b87c03ec3971229ce1b931d8cb73e9a5fe81
Instruction ID: 5a8b052af42448d0df62f79ae26deaaf12a6c5602022c6da425243ec5e057af5
Opcode Fuzzy Hash: 10ce5bc18453f0e0975be722a1f3b87c03ec3971229ce1b931d8cb73e9a5fe81
Instruction Fuzzy Hash: 69114C71346641C6DA14CB56D488B5E3366F795F89F0AC518CD0E07318FF38D889C781

Function 61CD1250 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 61CD127D
_Py_Dealloc.PYTHON310 ref: 61CD1293
PyNumber_Positive.PYTHON310 ref: 61CD12A4
PyNumber_Invert.PYTHON310 ref: 61CD12B0
PyNumber_Negative.PYTHON310 ref: 61CD12C0

Strings

Invalid operator, xrefs: 61CD1273

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Number_$DeallocErr_InvertNegativePositiveString
String ID: Invalid operator
API String ID: 4031754375-2676212410
Opcode ID: 72d0c2d83629f9037b9bdd1e17e0b47a42f0d58b5ededfb50bded83a974b757d
Instruction ID: 0ee70d3685d96904825a35e0242c6dd309fb5ca0fad1fb29fe08804fd833db2e
Opcode Fuzzy Hash: 72d0c2d83629f9037b9bdd1e17e0b47a42f0d58b5ededfb50bded83a974b757d
Instruction Fuzzy Hash: 2BF062B0A55900C1FA544BFDEC8436D7772BB46B95F0C8511DB1982229EF3B8168C341

Function 61D417C0 Relevance: 9.1, APIs: 6, Instructions: 137stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 61D417DD
_stat64.MSVCRT ref: 61D4182B
malloc.MSVCRT ref: 61D41943
memcpy.MSVCRT ref: 61D41958
_stat64.MSVCRT ref: 61D4196B
free.MSVCRT ref: 61D41980

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: _stat64$freemallocmemcpystrlen
String ID:
API String ID: 4289191721-0
Opcode ID: 4d7a6d4c6dcb027b6a3bc167a2f0e3da75f65b1265891d513389d37f7046c032
Instruction ID: 253301459385229157bde87f3cbf9c6027c15ef475b545e8e0efe2046cc71bc0
Opcode Fuzzy Hash: 4d7a6d4c6dcb027b6a3bc167a2f0e3da75f65b1265891d513389d37f7046c032
Instruction Fuzzy Hash: 0451B326509790D9F7118F61E05036E7BB2EB8EBD8F48C111DAE407758E73EE069C792

Function 61CD0810 Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

PyEval_GetGlobals.PYTHON310 ref: 61CD0821
PyDict_SetItem.PYTHON310 ref: 61CD0899
PyDict_GetItem.PYTHON310 ref: 61CD08BD
PyDict_DelItem.PYTHON310 ref: 61CD08D6

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Dict_Item$Eval_Globals
String ID:
API String ID: 298195719-0
Opcode ID: 86988c10532e077e80b5825ff2ba1060779fab3d626464a32cb766e7e630b190
Instruction ID: b354fb70988a44d4ef5a8881456140d15e3ca951d22d32111b5d564d8d9443ee
Opcode Fuzzy Hash: 86988c10532e077e80b5825ff2ba1060779fab3d626464a32cb766e7e630b190
Instruction Fuzzy Hash: DA117062F06615C6FD0AA7AE7C1638D5152AB88FD8F4DC535CE0986718FD38C8E3C650

Function 61CD0170 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

exit.MSVCRT ref: 61CD0179
VirtualAlloc.KERNEL32 ref: 61CD029B
memcpy.MSVCRT ref: 61CD02BB

Strings

Failed to alloc memory for spp code, xrefs: 61CD03BB

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: AllocVirtualexitmemcpy
String ID: Failed to alloc memory for spp code
API String ID: 693558432-822294455
Opcode ID: 26119ea84156512c57a93ab792000b700541bf175302572ab37c735e4265d942
Instruction ID: f588416877c51ce70a58660432327294649ba252f7b3af5c444d3b3cf1c804cd
Opcode Fuzzy Hash: 26119ea84156512c57a93ab792000b700541bf175302572ab37c735e4265d942
Instruction Fuzzy Hash: D55156B2B46B44C2EB158B4AE88475E77A5FB49BD4F49812ADF5C877A4EF38C061C300

Function 61CD0EA5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON310 ref: 61CD0E94
PyErr_GivenExceptionMatches.PYTHON310 ref: 61CD0ED6
PyTuple_Size.PYTHON310 ref: 61CD0F83
PyErr_SetString.PYTHON310 ref: 61CD0FF1

Strings

catching classes that do not inherit from BaseException is not allowed, xrefs: 61CD0FE5

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$DeallocExceptionGivenMatchesSizeStringTuple_
String ID: catching classes that do not inherit from BaseException is not allowed
API String ID: 1667255942-1287988286
Opcode ID: 4794c806348665f5b83715d950b53f4be660b4d4c70c339a3d9955c085e1bf86
Instruction ID: 822ecfd5c47890bb366ebf1840e99fc1a34e8a1eaea6fe7e8a624cb256221781
Opcode Fuzzy Hash: 4794c806348665f5b83715d950b53f4be660b4d4c70c339a3d9955c085e1bf86
Instruction Fuzzy Hash: FE214472B05B44D1EB058B6EE58079D3BA2AB42F98F18C065CF8DA7724EF39C0A5C351

Function 00007FFB0BA317B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON310 ref: 00007FFB0BA317CB
PyErr_SetString.PYTHON310 ref: 00007FFB0BA3180D
PyBuffer_Release.PYTHON310 ref: 00007FFB0BA3181A

Strings

y*:process, xrefs: 00007FFB0BA317C1
BrotliEncoderCompressStream failed while processing the stream, xrefs: 00007FFB0BA31806

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: Arg_Buffer_Err_ParseReleaseSizeStringTuple_
String ID: BrotliEncoderCompressStream failed while processing the stream$y*:process
API String ID: 2872489292-243030088
Opcode ID: cb8378cd060a40f59fa4d56021550bc41c31a91fa3c041aef3c9e0e738a50166
Instruction ID: 6e2aff33e2e4b768ea17fa645a984212c109b980dc75101a0b1abde5818a2fde
Opcode Fuzzy Hash: cb8378cd060a40f59fa4d56021550bc41c31a91fa3c041aef3c9e0e738a50166
Instruction Fuzzy Hash: 68F081D2F0974281EF159B71D8508B963A1BF98F85B448032DD5E87B34EE3CE5958600

Function 61CD1430 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CD1437
PyErr_Format.PYTHON310 ref: 61CD1466
PyErr_Format.PYTHON310 ref: 61CD1485

Strings

No active exception to reraise, xrefs: 61CD145C
local variable referenced before assignment, xrefs: 61CD147B

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$Format$Occurred
String ID: No active exception to reraise$local variable referenced before assignment
API String ID: 1084603930-1116140797
Opcode ID: 153211c257bc3c701679cc37a868dcc593d2a40b120f780d67d6ecf5787985c6
Instruction ID: 0c08b7093e71375221b02caf93ded2bb198747667dd03db2b45b2988366fb7d1
Opcode Fuzzy Hash: 153211c257bc3c701679cc37a868dcc593d2a40b120f780d67d6ecf5787985c6
Instruction Fuzzy Hash: C6F01C74B01705C1EF059BF9E9843D823B2AB48B99F4D8412CD0847329EE6EC0E9C380

Function 61CD3280 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 61CD3336
sprintf.MSVCRT ref: 61CD3360

Strings

No any serial number of harddisk got, xrefs: 61CD33A5
/%d:, xrefs: 61CD330B, 61CD331D
../src/platforms/windows/hdinfo.c, xrefs: 61CD33AC

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: sprintfstrlen
String ID: ../src/platforms/windows/hdinfo.c$/%d:$No any serial number of harddisk got
API String ID: 1090396089-4267867539
Opcode ID: 27835472972962e7d8b12cca516c6a3ea77c9fb4c442a91a80035d52b9fe9b72
Instruction ID: f516c0985321f488a7e303030dda787d0a3607572fbef158341e49029eea568b
Opcode Fuzzy Hash: 27835472972962e7d8b12cca516c6a3ea77c9fb4c442a91a80035d52b9fe9b72
Instruction Fuzzy Hash: E6314BA3F19450C9E711CBBAAC503AD6662A786FE4F8CD221CF255B785FE398587C301

Function 61CD2210 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

PyFunction_NewWithQualName.PYTHON310 ref: 61CD225C
_Py_Dealloc.PYTHON310 ref: 61CD22E7

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: DeallocFunction_NameQualWith
String ID:
API String ID: 2691592392-0
Opcode ID: f95b4e2e66a4c9c8375b2ea10285f41ef03a86e359eb67a7339921d62caba8c1
Instruction ID: a42d98bdad1160b31b6e96f2b03863f22a07528599c1e2c0a06c5de40267255d
Opcode Fuzzy Hash: f95b4e2e66a4c9c8375b2ea10285f41ef03a86e359eb67a7339921d62caba8c1
Instruction Fuzzy Hash: 18318532A46B41C6FA1A9FB6A96436D76A8F746FA4F0CC024EF5906B14FF35C0A1C340

Function 61CE1AF0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 97COMMON

Download Yara Rule

Strings

N != NULL, xrefs: 61CE1C3D
src/math/rand_prime.c, xrefs: 61CE1C36

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID:
String ID: N != NULL$src/math/rand_prime.c
API String ID: 0-3192267683
Opcode ID: a132fe9d3c931d8f367e0c198a045378a66cf2e5c59796bcdd1bb30ee8564d6d
Instruction ID: 8a03e82c189c03bafe364b2dc353582702c33b511c06ead68af5f0a49eba3cb1
Opcode Fuzzy Hash: a132fe9d3c931d8f367e0c198a045378a66cf2e5c59796bcdd1bb30ee8564d6d
Instruction Fuzzy Hash: 9C313872704641C6EB119B5ABC0879E6B75B785BD8F488525ED0A8BB94FB3CC465C700

Function 61CC2C80 Relevance: 7.6, APIs: 5, Instructions: 60librarystringloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 61CC2E6A
strlen.MSVCRT ref: 61CC2E82

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: AddressProcstrlen
String ID:
API String ID: 2109734435-0
Opcode ID: f2e846fb2c19a8523d0ca7eeedb091a186ec1a5d0f146ef45fe447df792cd647
Instruction ID: 4a35bbdb5e5d2b9d7c81e8ca6d4bb91113a2a09e553d019872794171873e2b5f
Opcode Fuzzy Hash: f2e846fb2c19a8523d0ca7eeedb091a186ec1a5d0f146ef45fe447df792cd647
Instruction Fuzzy Hash: 6F110222751AD895EB009B66DC44BAD7B21FB8AF95F4CC021ED2D07351DE2CC802C301

Function 61CCA3E0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 61CC87F0: _PyFloat_Unpack8.PYTHON310 ref: 61CC8821

PyErr_Occurred.PYTHON310 ref: 61CCA404
PyErr_Occurred.PYTHON310 ref: 61CCA5CD

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_Occurred$Float_Unpack8
String ID:
API String ID: 3006406168-0
Opcode ID: 501b29d1d3876e6448bb05cf927f858b29cca4c8a5f6e17b70dd6bb2755f4a3d
Instruction ID: 700063acca4311d444a2fd7ae59b684fe26d229d725ecb24c1246fac8a45204f
Opcode Fuzzy Hash: 501b29d1d3876e6448bb05cf927f858b29cca4c8a5f6e17b70dd6bb2755f4a3d
Instruction Fuzzy Hash: A3118671646640C6E605CBA6D058B5F3376FBA6F85F16D209DD0A17224FF35DC82C782

Function 61CCA323 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 61CC8C40: memcpy.MSVCRT ref: 61CC8C99
Part of subcall function 61CC8C40: PyOS_string_to_double.PYTHON310 ref: 61CC8CAB

PyErr_Occurred.PYTHON310 ref: 61CCA347
PyErr_Occurred.PYTHON310 ref: 61CCA62D

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_Occurred$S_string_to_doublememcpy
String ID:
API String ID: 282781714-0
Opcode ID: c92175cb6d05acbed655bdbcef24bb8094a85041decfb6504dfb460c26d3c054
Instruction ID: 39158dc4696a97b758ac24358758e0424e49de78a4dd056024315e0b64323962
Opcode Fuzzy Hash: c92175cb6d05acbed655bdbcef24bb8094a85041decfb6504dfb460c26d3c054
Instruction Fuzzy Hash: A6118171646640C6E605CBA5C058B5F3366FBA6F85F06D605CE0A17220FF34DC82D782

Function 61D1E1B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 233fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61D1E464
abort.MSVCRT ref: 61D1E469

Strings

', xrefs: 61D1E4CE
illegal index register, xrefs: 61D1E44F

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: abortfwrite
String ID: '$illegal index register
API String ID: 1067672060-451399654
Opcode ID: d8045887cefa271ab4d95c9c88bb710ecd9ca9a72e7eb7164d5dd68a5b67e7d3
Instruction ID: 245a7da7f567c917555c6a268769fb94b89fa592ec1747f1a8938a659fe2b8d3
Opcode Fuzzy Hash: d8045887cefa271ab4d95c9c88bb710ecd9ca9a72e7eb7164d5dd68a5b67e7d3
Instruction Fuzzy Hash: 60916F7361AB85C4DB138F3EE891A4C7FA5E399F88B9AC112CA4C47B14CA7EC456C711

Function 61CD03E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 61CD0439
memcpy.MSVCRT ref: 61CD045C
fwrite.MSVCRT ref: 61CD04EC

Strings

Failed to alloc memory for bcc code, xrefs: 61CD04D7

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: AllocVirtualfwritememcpy
String ID: Failed to alloc memory for bcc code
API String ID: 1603020442-783995166
Opcode ID: 199a802a124f0dd70cb6bb3c104f8fb294057d05e5e58635235ee5b3f5035209
Instruction ID: f9496922404758f1185bf47c97da41e61d4e8b8187d92ecdd8efba19aa8409af
Opcode Fuzzy Hash: 199a802a124f0dd70cb6bb3c104f8fb294057d05e5e58635235ee5b3f5035209
Instruction Fuzzy Hash: 43219AB2702B5486DB548F5AE881B6D7BA4F70DFD8F488526DF4D83754EA38C0A2C350

Function 00007FFB0BC4EC60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB0BC4ECAD

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB0BC4EC90, 00007FFB0BC4ED5D

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: 9d5941e97ec8f3985dd6b0ab3c94dbc12eaf10c5b908c9047e169af9a99035f8
Instruction ID: 8934e019b6f09985a1c5f0f5aff2c893b60922d21ff143ab9feff22e73eb7708
Opcode Fuzzy Hash: 9d5941e97ec8f3985dd6b0ab3c94dbc12eaf10c5b908c9047e169af9a99035f8
Instruction Fuzzy Hash: 373161B1A08B4296E778CF25E444BA97360FB84B84F588535EA8E87BB5CF3DD551C700

Function 61CC9F10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CC9F20
PyErr_SetString.PYTHON310 ref: 61CCA689

Strings

bad marshal data (string size out of range), xrefs: 61CCA67F

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$OccurredString
String ID: bad marshal data (string size out of range)
API String ID: 114435612-3115314950
Opcode ID: 458014c8a6e3af0f62bfaed9ccb612366736837fab92ed0431f7c9052f3e7ec3
Instruction ID: e73ae8f25f1755b4b96d63e83515f4e6ed0dc9f89379c68fc2a5a4eb5c18eff4
Opcode Fuzzy Hash: 458014c8a6e3af0f62bfaed9ccb612366736837fab92ed0431f7c9052f3e7ec3
Instruction Fuzzy Hash: B0119132206684C5EA128B59E4447AE73A1AB98F99F09C524CE4D07764FE38DCC9C781

Function 61CCA4C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 61CCA749
PyErr_Occurred.PYTHON310 ref: 61CCA949
PyErr_SetString.PYTHON310 ref: 61CCB2EF

Strings

bad marshal data (invalid reference), xrefs: 61CCA73C, 61CCB2E2

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_$String$Occurred
String ID: bad marshal data (invalid reference)
API String ID: 1118661901-2759865940
Opcode ID: 16c5e58cc9f47daac184bdf30a1e0a24ba23ab9177b4635868d307f7b9b733bd
Instruction ID: 6e982ceabedc4663d5d83811890827929e173cced57f00a71dca263827d6c6ce
Opcode Fuzzy Hash: 16c5e58cc9f47daac184bdf30a1e0a24ba23ab9177b4635868d307f7b9b733bd
Instruction Fuzzy Hash: 1E11E9B1211A41D6EA04CB6AD484B9E33B6F785F98F47D605CA1E07224EF39D8D9C741

Function 00007FFB0BA31410 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

PyLong_AsLong.PYTHON310 ref: 00007FFB0BA31432
PyErr_SetString.PYTHON310 ref: 00007FFB0BA31461

Strings

Invalid lgblock. Can be 0 or in range 16 to 24., xrefs: 00007FFB0BA31453
Invalid lgblock, xrefs: 00007FFB0BA31429

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: Err_LongLong_String
String ID: Invalid lgblock$Invalid lgblock. Can be 0 or in range 16 to 24.
API String ID: 568964304-2070589380
Opcode ID: 98ac89e9ae3e119ae39c4b923ceb1be476487f23198bc6fec9af8334a5baf927
Instruction ID: 18d7a26a73754738869a613121de4f2df3f0328c823c4fc3498e112715ff98a0
Opcode Fuzzy Hash: 98ac89e9ae3e119ae39c4b923ceb1be476487f23198bc6fec9af8334a5baf927
Instruction Fuzzy Hash: 40F05EF2E0860382FB955775E454A782290FF58B45F94D431E85EC52B0EF5CE8D58700

Function 00007FFB0BA313B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyLong_AsLong.PYTHON310 ref: 00007FFB0BA313D2
PyErr_SetString.PYTHON310 ref: 00007FFB0BA313FB

Strings

Invalid lgwin, xrefs: 00007FFB0BA313C9
Invalid lgwin. Range is 10 to 24., xrefs: 00007FFB0BA313ED

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: Err_LongLong_String
String ID: Invalid lgwin$Invalid lgwin. Range is 10 to 24.
API String ID: 568964304-1865904581
Opcode ID: 7bd72e1ab808d5623974b6b25a33f8bd190c734804e523a2af81955fbb258cdb
Instruction ID: fc2e9ab460fd26d80ad253d9b4639581f0fed435e032bfc8f4ae2348c0fa3784
Opcode Fuzzy Hash: 7bd72e1ab808d5623974b6b25a33f8bd190c734804e523a2af81955fbb258cdb
Instruction Fuzzy Hash: 7EF0A0F2E0860686EB559B75D494AB823A0EF58B50F94D031D90F8A670EF2CD8D9C700

Function 00007FFB0BA31350 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

PyLong_AsLong.PYTHON310 ref: 00007FFB0BA31372
PyErr_SetString.PYTHON310 ref: 00007FFB0BA31398

Strings

Invalid quality. Range is 0 to 11., xrefs: 00007FFB0BA3138A
Invalid quality, xrefs: 00007FFB0BA31369

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: Err_LongLong_String
String ID: Invalid quality$Invalid quality. Range is 0 to 11.
API String ID: 568964304-3078312006
Opcode ID: bf0f2c2d88753ce6f75839a482aaea8b1615882223bf6accab7f266c8a4c0845
Instruction ID: 7851304cf9b4c50d4efc10fb979f3690ef7e720543dd3bf73e31dc5d980e4645
Opcode Fuzzy Hash: bf0f2c2d88753ce6f75839a482aaea8b1615882223bf6accab7f266c8a4c0845
Instruction Fuzzy Hash: D2F065E2E09642C6F7559B75D49467823A0FF58B51F94D031D90ECA670EF2CD8D5C700

Function 00007FFB0BA60510 Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB0BA605E4
memmove.VCRUNTIME140 ref: 00007FFB0BA605FE
memmove.VCRUNTIME140 ref: 00007FFB0BA60675

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: memmove$exit
String ID:
API String ID: 987259897-0
Opcode ID: 79d9dcba4dee088979e62e56151a7632dd868efc27c5ebe9eaf823a5f0b8b74d
Instruction ID: 72e7098d96ab373355605f3c046c3c084b503f42a9f1a15147bc52f893a95398
Opcode Fuzzy Hash: 79d9dcba4dee088979e62e56151a7632dd868efc27c5ebe9eaf823a5f0b8b74d
Instruction Fuzzy Hash: 7DD17FB6609B8186DA24CB26E544B6EB3A5FB98BD0F059436CF9E47B58DF3CD0948700

Function 00007FFB0BA635B0 Relevance: 6.3, APIs: 4, Instructions: 318COMMON

Download Yara Rule

APIs

exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB0BA63687
memmove.VCRUNTIME140 ref: 00007FFB0BA636A3
memmove.VCRUNTIME140 ref: 00007FFB0BA63726

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: memmove$exit
String ID:
API String ID: 987259897-0
Opcode ID: 640fcf2c863d9de54116d5ac512887b9e22b6727d00535a97327216d7780aaef
Instruction ID: cc689502220df48d77b48b2208a2330d2b30881481ba26bca586a334134aad36
Opcode Fuzzy Hash: 640fcf2c863d9de54116d5ac512887b9e22b6727d00535a97327216d7780aaef
Instruction Fuzzy Hash: 5BD19DA6709B8186DE24CB2AE50876AB3A5FB98BC0F049439CF8E47B64DF3CD055C314

Function 00007FFB0BA61D60 Relevance: 6.3, APIs: 4, Instructions: 318COMMON

Download Yara Rule

APIs

exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB0BA61E37
memmove.VCRUNTIME140 ref: 00007FFB0BA61E53
memmove.VCRUNTIME140 ref: 00007FFB0BA61ED6

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: memmove$exit
String ID:
API String ID: 987259897-0
Opcode ID: 59702072734e8ad1273f19b6d99c79a4969c51d14cc5c672e670c6c0901996cd
Instruction ID: 5cbbcaea6dd1ec59c336fb5387c1b439fc1c900f15ac6b87a4b213b2be44493c
Opcode Fuzzy Hash: 59702072734e8ad1273f19b6d99c79a4969c51d14cc5c672e670c6c0901996cd
Instruction Fuzzy Hash: B8D191B2709B8186DA258F26E54876AB7A5FB88BC0F049436DF8E57B68DF3CD450C300

Function 00007FFB0BA68880 Relevance: 6.2, APIs: 4, Instructions: 227COMMON

Download Yara Rule

APIs

log2.API-MS-WIN-CRT-MATH-L1-1-0(00000000,?,?,00007FFB0BA68FCA), ref: 00007FFB0BA6894A
log2.API-MS-WIN-CRT-MATH-L1-1-0(00000000,?,?,00007FFB0BA68FCA), ref: 00007FFB0BA6898F
log2.API-MS-WIN-CRT-MATH-L1-1-0(00000000,?,?,00007FFB0BA68FCA), ref: 00007FFB0BA689D4
memmove.VCRUNTIME140(00000000,?,?,00007FFB0BA68FCA), ref: 00007FFB0BA68A95

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: log2$memmove
String ID:
API String ID: 3336697533-0
Opcode ID: 37c08e7e4291ae7c0fd9f5e7d1ae2ed9a98bb0acaa0912484a1cbda665e6c135
Instruction ID: e163bb99d5f88e6820b502aca224ca0ab6b0a2b09fbe7561eacd524dd2b77570
Opcode Fuzzy Hash: 37c08e7e4291ae7c0fd9f5e7d1ae2ed9a98bb0acaa0912484a1cbda665e6c135
Instruction Fuzzy Hash: 8EB1B8A2A19F8589D6128F38D0017BDB368FF99784F14D737DB8A66664DF3CA592C200

Function 00007FFB0BA69140 Relevance: 6.2, APIs: 4, Instructions: 227COMMON

Download Yara Rule

APIs

log2.API-MS-WIN-CRT-MATH-L1-1-0(00000000,?,?,00007FFB0BA6988A), ref: 00007FFB0BA6920A
log2.API-MS-WIN-CRT-MATH-L1-1-0(00000000,?,?,00007FFB0BA6988A), ref: 00007FFB0BA6924F
log2.API-MS-WIN-CRT-MATH-L1-1-0(00000000,?,?,00007FFB0BA6988A), ref: 00007FFB0BA69294
memmove.VCRUNTIME140(00000000,?,?,00007FFB0BA6988A), ref: 00007FFB0BA69355

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: log2$memmove
String ID:
API String ID: 3336697533-0
Opcode ID: 1680cdc6a483d2b4af0fd29261cfd8d16fc7ddb78b32cb5b10661259ba284ebb
Instruction ID: 5476be56390166f4c892d31dea424683be8ffd7a85b60791b8300be23b1103a3
Opcode Fuzzy Hash: 1680cdc6a483d2b4af0fd29261cfd8d16fc7ddb78b32cb5b10661259ba284ebb
Instruction Fuzzy Hash: 8DB1ABA2A18F8589D6128F38D1057BAB364FF9D784F14D336DB8E66661DF38D592C300

Function 00007FFB0BA80740 Relevance: 6.2, APIs: 4, Instructions: 163COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFB0BA80840
memmove.VCRUNTIME140 ref: 00007FFB0BA808BF
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB0BA80910
memset.VCRUNTIME140 ref: 00007FFB0BA8095F

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: memmove$exitmemset
String ID:
API String ID: 2725257846-0
Opcode ID: 7667acfe8cd979c61ef8322217f9533025dc7a57991cc5d72a4afbdb4d25e19c
Instruction ID: b596c6049b5d1a31b858bb231656b236fa754e41070b85548e0c6e7d1bc69965
Opcode Fuzzy Hash: 7667acfe8cd979c61ef8322217f9533025dc7a57991cc5d72a4afbdb4d25e19c
Instruction Fuzzy Hash: D8613F72604B9182EA65CF22F5447AA73A4FB49B84F498435DF8E87B54DF3CD494C340

Function 00007FFB0BA66C30 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB0BA66C73
memset.VCRUNTIME140 ref: 00007FFB0BA66CD6
memset.VCRUNTIME140 ref: 00007FFB0BA66D08
memset.VCRUNTIME140 ref: 00007FFB0BA66D2D

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: memset$exit
String ID:
API String ID: 2160831268-0
Opcode ID: ff7542eb6b03d18410631e71f5cf1605c2db0e3aae92597e952d8736e1c6e287
Instruction ID: 3f6786bfd6229b8246dbab639e7f55b79b252fad8abbc18a29b4b5b12b168034
Opcode Fuzzy Hash: ff7542eb6b03d18410631e71f5cf1605c2db0e3aae92597e952d8736e1c6e287
Instruction Fuzzy Hash: 1971D176608BC586D760CF26F88079AB7A4F788B84F54912AEEDD43B68DF38C155CB40

Function 00007FFB0BA7E640 Relevance: 6.1, APIs: 4, Instructions: 135COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFB0BA7E728
memmove.VCRUNTIME140 ref: 00007FFB0BA7E7A1
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB0BA7E7E8
memset.VCRUNTIME140 ref: 00007FFB0BA7E809

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: memmove$exitmemset
String ID:
API String ID: 2725257846-0
Opcode ID: d9c9cb1ef6c5c71233e29e4e1958d91413e7428d0f52581b9b1aba8afdf679da
Instruction ID: 7ce56501860cc2e6dcec91f27de95bee35f90cca651d23dac1126c0b4a0d64b4
Opcode Fuzzy Hash: d9c9cb1ef6c5c71233e29e4e1958d91413e7428d0f52581b9b1aba8afdf679da
Instruction Fuzzy Hash: 4E5120B2609B8182DB259F26F9447A9B3A8FB48B84F588535DF9E47B64DF3CD090C344

Function 00007FFB0BA7FC90 Relevance: 6.1, APIs: 4, Instructions: 135COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFB0BA7FD78
memmove.VCRUNTIME140 ref: 00007FFB0BA7FDF1
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB0BA7FE38
memset.VCRUNTIME140 ref: 00007FFB0BA7FE59

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: memmove$exitmemset
String ID:
API String ID: 2725257846-0
Opcode ID: 23cfdeea8cd9a323e5b039c749b7dda14dfd5c35ac79cae9b21fed405305592a
Instruction ID: 53afc2dba72cac55f46a0bb6f7117ca6e863776227a2c838def99f5103a86006
Opcode Fuzzy Hash: 23cfdeea8cd9a323e5b039c749b7dda14dfd5c35ac79cae9b21fed405305592a
Instruction Fuzzy Hash: D7514272609B8186DB258F22F944BA9B3A4FB48B84F488535DF9E47B65DF3DD190C340

Function 00007FFB0BA7F1E0 Relevance: 6.1, APIs: 4, Instructions: 135COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFB0BA7F2C8
memmove.VCRUNTIME140 ref: 00007FFB0BA7F341
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB0BA7F388
memset.VCRUNTIME140 ref: 00007FFB0BA7F3A9

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: memmove$exitmemset
String ID:
API String ID: 2725257846-0
Opcode ID: 493e27849c4cb9e9b95d7c30d5e6413da0b50b6e21a947d19d361f36feff194b
Instruction ID: 21b833916852a3f4d47a9541ebdcb05a5482e7d2253fd3236e7a3f45c40d5ef2
Opcode Fuzzy Hash: 493e27849c4cb9e9b95d7c30d5e6413da0b50b6e21a947d19d361f36feff194b
Instruction Fuzzy Hash: 445150B2609B8186DB258F22F9407A9B3A4FB48B84F488535DF9E87B64DF3DD590C344

Function 61CC1010 Relevance: 6.1, APIs: 4, Instructions: 131sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 61CC1057
_amsg_exit.MSVCRT ref: 61CC1081

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 7b400966ea0fe65b8107637a16397435112a5280b413d6e50a40906f42bf94e7
Instruction ID: c45eb0a3f1a1fb284d86554c0be28c529dc7274c4173474222e4ce3acb556b14
Opcode Fuzzy Hash: 7b400966ea0fe65b8107637a16397435112a5280b413d6e50a40906f42bf94e7
Instruction Fuzzy Hash: 2A413A36712654C9F7028F9FEC5079A26B6BB85BD5F488026CE1C87364FE39D8928351

Function 00007FFB0BA69CA0 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFB0BA69CFA
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB0BA69D4B
memmove.VCRUNTIME140 ref: 00007FFB0BA69D96
memmove.VCRUNTIME140 ref: 00007FFB0BA69DEE

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: memmove$exitmemset
String ID:
API String ID: 2725257846-0
Opcode ID: a32b4bb5653312606587a6e74c96ac44aa3f345004107e7812205a3e2226a543
Instruction ID: e85cee049bd0c4b9df168f62f1f88bb82bc2e8af7c8419eea43d9bde9895b253
Opcode Fuzzy Hash: a32b4bb5653312606587a6e74c96ac44aa3f345004107e7812205a3e2226a543
Instruction Fuzzy Hash: 6741E1B2B0474186DA149E26E444A6AB355FB89BD0F49C239DEAE877E4DF3CE841C740

Function 61CE2760 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

Strings

in != NULL, xrefs: 61CE28B9
src/pk/asn1/der/sequence/der_decode_sequence_multi.c, xrefs: 61CE28B2

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID:
String ID: in != NULL$src/pk/asn1/der/sequence/der_decode_sequence_multi.c
API String ID: 0-85593093
Opcode ID: 5390f7802ef71949aa3a0cf05dea8c3b14533773d64808a5d6f4aa100e05040b
Instruction ID: c6423a2cd50675e01ae8f8c802061b1ce9a25c3130784001f26a318f6107319f
Opcode Fuzzy Hash: 5390f7802ef71949aa3a0cf05dea8c3b14533773d64808a5d6f4aa100e05040b
Instruction Fuzzy Hash: 6A310633714681CAEB25CF6AE424B5D3765F785BD8F588028EE4D47B58EB39C491CB00

Function 00007FFB0BC21BA9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

BIO_find_type.LIBCRYPTO-1_1 ref: 00007FFB0BC24B20
BIO_find_type.LIBCRYPTO-1_1 ref: 00007FFB0BC24B30
BIO_get_data.LIBCRYPTO-1_1 ref: 00007FFB0BC24B45
BIO_get_data.LIBCRYPTO-1_1 ref: 00007FFB0BC24B50

Memory Dump Source

Source File: 00000003.00000002.2630577960.00007FFB0BC21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB0BC20000, based on PE: true

Associated: 00000003.00000002.2630562409.00007FFB0BC20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630577960.00007FFB0BC94000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630637059.00007FFB0BC96000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630663082.00007FFB0BCB9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCBE000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCC4000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0bc20000_grass.jbxd

Similarity

API ID: O_find_typeO_get_data
String ID:
API String ID: 280995463-0
Opcode ID: ea4ae0ada7687b9278b86a77c40726f248b152b0eba2a9966a3d191204c08946
Instruction ID: 4b3d14ed7a2f6b967a53fddd63265bef397439d6a090817a1a0a5ce48eb8c646
Opcode Fuzzy Hash: ea4ae0ada7687b9278b86a77c40726f248b152b0eba2a9966a3d191204c08946
Instruction Fuzzy Hash: FF018051F0DA4262FA68976AE001B6962919F44BD0F08D030EE0FCBFAADE2DE8414300

Function 61CCA2D0 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 61CC87F0: _PyFloat_Unpack8.PYTHON310 ref: 61CC8821

PyErr_Occurred.PYTHON310 ref: 61CCA2F0
PyFloat_FromDouble.PYTHON310 ref: 61CCA5F4

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Float_$DoubleErr_FromOccurredUnpack8
String ID:
API String ID: 4123378784-0
Opcode ID: adc10c1c1c7a10ac8db4f3d43ac0f240f06528aaff7345986a48d1d595e362b8
Instruction ID: 285340b01a6d5069c4e9ae03c0154544d5630f9c6f63eaf4c6251691b139786f
Opcode Fuzzy Hash: adc10c1c1c7a10ac8db4f3d43ac0f240f06528aaff7345986a48d1d595e362b8
Instruction Fuzzy Hash: 6C012171246650C6E605DBA6C458B5F73A6FB95F85F0BD608DE0A07224FF34EC85C782

Function 61CCA484 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 61CC8C40: memcpy.MSVCRT ref: 61CC8C99
Part of subcall function 61CC8C40: PyOS_string_to_double.PYTHON310 ref: 61CC8CAB

PyErr_Occurred.PYTHON310 ref: 61CCA4A4
PyFloat_FromDouble.PYTHON310 ref: 61CCA654

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: DoubleErr_Float_FromOccurredS_string_to_doublememcpy
String ID:
API String ID: 1362591179-0
Opcode ID: 1f6ed32d32fc598d43466fbde0f00dfe1b7339860388028654317f4caba24889
Instruction ID: 03573d3ad62d192e44943cc2642d1dbc786ac132248e6333beb52e2d23d4f696
Opcode Fuzzy Hash: 1f6ed32d32fc598d43466fbde0f00dfe1b7339860388028654317f4caba24889
Instruction Fuzzy Hash: 79012171246200CAE605CFA6D458B5E33AAFB96F85F07D608CD1A07224FB34EC85CB82

Function 61CCA1E0 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CCA1EA
PyLong_FromLong.PYTHON310 ref: 61CCACA4

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_FromLongLong_Occurred
String ID:
API String ID: 4098471257-0
Opcode ID: 71677222d0491e34343a4c14b71c1dc1311d857c050d9e14bf58198066bcd62d
Instruction ID: 62845deccd0d7689ac583c8e8f396f64a4567ca9aaab6d45b4cfc9023d217ce0
Opcode Fuzzy Hash: 71677222d0491e34343a4c14b71c1dc1311d857c050d9e14bf58198066bcd62d
Instruction Fuzzy Hash: 9301F671346210C7EA08CBA6C458B1E32A7FB95F85F0AD518CE1A07214FE34EC84CB81

Function 00007FFB0BA68460 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB0BA684CC
memmove.VCRUNTIME140 ref: 00007FFB0BA6873E

Strings

@, xrefs: 00007FFB0BA68601

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: exitmemmove
String ID: @
API String ID: 1790971451-2766056989
Opcode ID: fb4b732d7ba2ad41e51b609ce057e87b5d2821d6290d3fdf268689399a755141
Instruction ID: 66efb119e5f19baeff96b4fa6a49f4347c21b28aafe0b8d7c6bedb879f7b4000
Opcode Fuzzy Hash: fb4b732d7ba2ad41e51b609ce057e87b5d2821d6290d3fdf268689399a755141
Instruction Fuzzy Hash: 30B16CA6A09BC586DA20CF15E5087AAA364F788FC4F189136DF8E57B59DF3CD185C700

Function 00007FFB0BA5A300 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA5A3D9
log2.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFB0BA5A439

Strings

Tg]@, xrefs: 00007FFB0BA5A465

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: log2
String ID: Tg]@
API String ID: 4048861018-1367013573
Opcode ID: 314978e01d248754fc8a1f8367cd94a51ede3c6cab710bddc8371ba00d0dbb51
Instruction ID: 385e2edc0fed5852771fd30067dc38d416be9965ce3d2d66a567e63b9c346dc7
Opcode Fuzzy Hash: 314978e01d248754fc8a1f8367cd94a51ede3c6cab710bddc8371ba00d0dbb51
Instruction Fuzzy Hash: 0C411A32B15B498AD6118F76D000AADB661FF49B88F14C331EA4B67764DF39E293DA00

Function 61CC80C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON310 ref: 61CC8120

Strings

%s (%d:%d), xrefs: 61CC8113

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: Err_Format
String ID: %s (%d:%d)
API String ID: 376477240-1595188566
Opcode ID: 8bb9e66f62ffad9c3a8cef4396e92e57eb793e3fc40e407dff63582044b2c1ee
Instruction ID: 6e1d6c2cad211b87336ccf9ef658c5b849cb8a58b7bb7422177c192e7836fd7d
Opcode Fuzzy Hash: 8bb9e66f62ffad9c3a8cef4396e92e57eb793e3fc40e407dff63582044b2c1ee
Instruction Fuzzy Hash: 56018F73A11654C5EB0197A9D8417CE37A1EBDAB88F8E8022CD5D173A1DF29C882D381

Function 61CDDD10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__iob_func.MSVCRT ref: 61CDDD20
abort.MSVCRT(?,?,?,?,?,61CD7E62), ref: 61CDDD41

Strings

LTC_ARGCHK '%s' failure on line %d of file %s, xrefs: 61CDDD26

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: __iob_funcabort
String ID: LTC_ARGCHK '%s' failure on line %d of file %s
API String ID: 1307436159-2823265812
Opcode ID: eee2c708d95ff40d082ddd57311eec4aade1f3c95749b20481556c841b4ca3f1
Instruction ID: 3363d6403771100e9ad16e3344740cbbfa7cbfe7b8c491d9f6609c4a2026166d
Opcode Fuzzy Hash: eee2c708d95ff40d082ddd57311eec4aade1f3c95749b20481556c841b4ca3f1
Instruction Fuzzy Hash: F5D0A774310B5AA1DB109B56AD04B9A6B71FBEEFDCF488010DD4D87F20AF25C12AC340

Function 00007FFB0BA312F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

PyLong_AsLong.PYTHON310 ref: 00007FFB0BA31309
PyErr_SetString.PYTHON310 ref: 00007FFB0BA31336

Strings

Invalid mode, xrefs: 00007FFB0BA3132F

Memory Dump Source

Source File: 00000003.00000002.2630238336.00007FFB0BA31000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFB0BA30000, based on PE: true

Associated: 00000003.00000002.2630220745.00007FFB0BA30000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630327470.00007FFB0BAF7000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2630343984.00007FFB0BAF8000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb0ba30000_grass.jbxd

Similarity

API ID: Err_LongLong_String
String ID: Invalid mode
API String ID: 568964304-431149109
Opcode ID: 2e3b143024fffb948b6d36cb644d747681586ed00adecaaa304b2e3236bd7830
Instruction ID: 05fc9bff91d8fe279af515eb990bacc2c911fa71fa20addecd4c75bad408bdaf
Opcode Fuzzy Hash: 2e3b143024fffb948b6d36cb644d747681586ed00adecaaa304b2e3236bd7830
Instruction Fuzzy Hash: 15F039E2E0464682F7556B75E494A7C2290EF58B52F989470D91ECAAB0DE2C98D68700

Function 61D41020 Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 61D41047
free.MSVCRT ref: 61D41098
LeaveCriticalSection.KERNEL32 ref: 61D410A4

Memory Dump Source

Source File: 00000003.00000002.2627421510.0000000061CC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000003.00000002.2627390328.0000000061CC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627506339.0000000061D42000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627530224.0000000061D46000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627550788.0000000061D47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627580629.0000000061D5F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627603165.0000000061D62000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627622916.0000000061D64000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2627643786.0000000061D68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61cc0000_grass.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: f4c2441ccf2d4738d7350e9699d6bb5203064618e76d4b4ca1b291ef5726c35c
Instruction ID: 39d0c2b2e777d498c4225076af6eacc6c7c098645c08f4264717fb5150523a81
Opcode Fuzzy Hash: f4c2441ccf2d4738d7350e9699d6bb5203064618e76d4b4ca1b291ef5726c35c
Instruction Fuzzy Hash: CF012171316651C6EB08CBA5E8D13A523B2F788BC0F989425C95DC7364EF3AE4B5C380

Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61CE5040 PyCMethod_New,CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,clock,clock,clock,clock,CryptReleaseContext,	3_2_61CE5040
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_61D41D19 CryptReleaseContext,	3_2_61D41D19
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2189D CRYPTO_malloc,ERR_put_error,	3_2_00007FFB0BC2189D
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2132A CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,	3_2_00007FFB0BC2132A
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC4CC00 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	3_2_00007FFB0BC4CC00
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21DA2 CRYPTO_THREAD_run_once,	3_2_00007FFB0BC21DA2
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC80B50 EVP_PKEY_get0_RSA,RSA_size,CRYPTO_malloc,RAND_priv_bytes,CRYPTO_free,	3_2_00007FFB0BC80B50
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21523 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	3_2_00007FFB0BC21523
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC4CB10 CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC4CB10
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21FBE CRYPTO_free,	3_2_00007FFB0BC21FBE
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC60AA0 CRYPTO_memcmp,	3_2_00007FFB0BC60AA0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC3CAC0 OPENSSL_sk_num,X509_STORE_CTX_new,ERR_put_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_put_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_put_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,	3_2_00007FFB0BC3CAC0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC5AA70 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	3_2_00007FFB0BC5AA70
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC54A90 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	3_2_00007FFB0BC54A90
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2221B CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC2221B
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC4C970 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	3_2_00007FFB0BC4C970
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC70990 CRYPTO_free,CRYPTO_free,CRYPTO_strndup,	3_2_00007FFB0BC70990
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC7C980 CRYPTO_memcmp,	3_2_00007FFB0BC7C980
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC28980 CRYPTO_free,	3_2_00007FFB0BC28980
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC22153 CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,ENGINE_finish,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	3_2_00007FFB0BC22153
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2135C memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	3_2_00007FFB0BC2135C
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC81060 BN_bin2bn,BN_ucmp,BN_is_zero,CRYPTO_free,CRYPTO_strdup,	3_2_00007FFB0BC81060
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21479 CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	3_2_00007FFB0BC21479
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC6B020 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,	3_2_00007FFB0BC6B020
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21410 CRYPTO_malloc,ERR_put_error,BIO_snprintf,	3_2_00007FFB0BC21410
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC6D050 EVP_CIPHER_CTX_free,CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC6D050
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC37008 CRYPTO_free,CRYPTO_strdup,	3_2_00007FFB0BC37008
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21078 CRYPTO_free,	3_2_00007FFB0BC21078
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC224FA CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	3_2_00007FFB0BC224FA
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC36F39 CRYPTO_free,CRYPTO_strdup,	3_2_00007FFB0BC36F39
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21DC0 BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_put_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	3_2_00007FFB0BC21DC0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2163B CRYPTO_free,CRYPTO_malloc,	3_2_00007FFB0BC2163B
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC54EF0 CRYPTO_zalloc,ERR_put_error,_time64,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,memcpy,	3_2_00007FFB0BC54EF0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2AEA0 CRYPTO_free,	3_2_00007FFB0BC2AEA0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC3CEC0 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC3CEC0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC58E70 CRYPTO_zalloc,CRYPTO_free,	3_2_00007FFB0BC58E70
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC60E70 CRYPTO_free,CRYPTO_memdup,	3_2_00007FFB0BC60E70
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC3CE60 CRYPTO_get_ex_new_index,	3_2_00007FFB0BC3CE60
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2157D CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,ERR_put_error,ERR_put_error,ERR_put_error,memcpy,	3_2_00007FFB0BC2157D
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC68E3D CRYPTO_malloc,	3_2_00007FFB0BC68E3D
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC88E40 CRYPTO_free,CRYPTO_malloc,ERR_put_error,	3_2_00007FFB0BC88E40
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21B81 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	3_2_00007FFB0BC21B81
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC72E00 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,	3_2_00007FFB0BC72E00
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2220C ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,OPENSSL_LH_new,OPENSSL_sk_num,EVP_get_digestbyname,EVP_get_digestbyname,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,RAND_bytes,RAND_priv_bytes,RAND_priv_bytes,RAND_priv_bytes,	3_2_00007FFB0BC2220C
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21393 OPENSSL_sk_new_null,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_clear_error,OPENSSL_sk_value,X509_get0_pubkey,X509_free,X509_up_ref,X509_free,OPENSSL_sk_pop_free,	3_2_00007FFB0BC21393
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC4CDC0 ERR_put_error,ERR_put_error,ERR_put_error,EVP_MD_size,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,d2i_X509,X509_get0_pubkey,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_put_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,ERR_put_error,	3_2_00007FFB0BC4CDC0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21F37 CRYPTO_free,CRYPTO_malloc,RAND_bytes,	3_2_00007FFB0BC21F37
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2ED90 EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp,	3_2_00007FFB0BC2ED90
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21D61 CRYPTO_clear_free,	3_2_00007FFB0BC21D61
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2243C CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,ERR_put_error,	3_2_00007FFB0BC2243C
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC22469 CRYPTO_malloc,memcpy,	3_2_00007FFB0BC22469
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC215C8 EVP_MD_CTX_new,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestSignInit,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestUpdate,EVP_DigestSignFinal,EVP_DigestSign,BUF_reverse,CRYPTO_free,EVP_MD_CTX_free,CRYPTO_free,EVP_MD_CTX_free,	3_2_00007FFB0BC215C8
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21F14 CRYPTO_free,	3_2_00007FFB0BC21F14
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC24497 CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	3_2_00007FFB0BC24497
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21A00 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	3_2_00007FFB0BC21A00
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC383F0 EVP_PKEY_CTX_new,EVP_PKEY_derive_init,EVP_PKEY_derive_set_peer,EVP_PKEY_derive,CRYPTO_malloc,EVP_PKEY_derive,CRYPTO_clear_free,EVP_PKEY_CTX_free,	3_2_00007FFB0BC383F0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC28410 CRYPTO_zalloc,ERR_put_error,	3_2_00007FFB0BC28410
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21E7E CRYPTO_free,CRYPTO_malloc,	3_2_00007FFB0BC21E7E
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21CBC CRYPTO_clear_free,	3_2_00007FFB0BC21CBC
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC3E3C0 CRYPTO_THREAD_run_once,	3_2_00007FFB0BC3E3C0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC36330 CRYPTO_free,	3_2_00007FFB0BC36330
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC72350 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC72350
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC462F0 ERR_put_error,CRYPTO_free,ERR_put_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	3_2_00007FFB0BC462F0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC213B6 CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC213B6
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC220FE BN_bin2bn,BN_is_zero,CRYPTO_free,CRYPTO_strdup,CRYPTO_clear_free,	3_2_00007FFB0BC220FE
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2E2E0 CRYPTO_malloc,	3_2_00007FFB0BC2E2E0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC742B0 CRYPTO_malloc,memcpy,	3_2_00007FFB0BC742B0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC22293 CRYPTO_free,CRYPTO_memdup,	3_2_00007FFB0BC22293
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC3C280 CRYPTO_zalloc,ERR_put_error,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,	3_2_00007FFB0BC3C280
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21131 CRYPTO_free,	3_2_00007FFB0BC21131
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC361F8 CRYPTO_free,CRYPTO_strdup,	3_2_00007FFB0BC361F8
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC3E180 COMP_zlib,CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	3_2_00007FFB0BC3E180
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC38130 CRYPTO_free,CRYPTO_memdup,	3_2_00007FFB0BC38130
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC22590 CRYPTO_free,CRYPTO_strdup,	3_2_00007FFB0BC22590
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2195B EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp,strncmp,strncmp,strncmp,strncmp,strncmp,	3_2_00007FFB0BC2195B
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC580F0 CRYPTO_free,	3_2_00007FFB0BC580F0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2E0B0 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,	3_2_00007FFB0BC2E0B0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC240BA BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	3_2_00007FFB0BC240BA
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC80830 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,	3_2_00007FFB0BC80830
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC60820 CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC60820
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC5A850 CRYPTO_free,CRYPTO_memdup,	3_2_00007FFB0BC5A850
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21C08 CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	3_2_00007FFB0BC21C08
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC6883B CRYPTO_clear_free,	3_2_00007FFB0BC6883B
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2101E CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC2101E
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2222A CRYPTO_free,	3_2_00007FFB0BC2222A
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC22225 CRYPTO_free,CRYPTO_memdup,	3_2_00007FFB0BC22225
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC7E730 OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,memcmp,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,CRYPTO_memcmp,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC7E730
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2218A CONF_parse_list,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC2218A
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC213FC EVP_MD_CTX_new,EVP_MD_CTX_free,CRYPTO_memcmp,memcpy,memcpy,	3_2_00007FFB0BC213FC
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21AC8 CRYPTO_malloc,ERR_put_error,CRYPTO_free,	3_2_00007FFB0BC21AC8
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC246C0 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	3_2_00007FFB0BC246C0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21762 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	3_2_00007FFB0BC21762
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC221C1 _time64,CRYPTO_free,CRYPTO_malloc,EVP_sha256,EVP_Digest,EVP_MD_size,CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC221C1
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21BCC CRYPTO_strdup,CRYPTO_free,	3_2_00007FFB0BC21BCC
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC5A5E0 CRYPTO_memcmp,	3_2_00007FFB0BC5A5E0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2236A CRYPTO_free,CRYPTO_malloc,ERR_put_error,memcpy,	3_2_00007FFB0BC2236A
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21050 EVP_PKEY_free,BN_num_bits,BN_bn2bin,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_clear_free,	3_2_00007FFB0BC21050
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21438 ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC21438
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC60550 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC60550
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC424E0 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	3_2_00007FFB0BC424E0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21DD4 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,OPENSSL_cleanse,OPENSSL_cleanse,EVP_MD_size,	3_2_00007FFB0BC21DD4
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC222C5 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	3_2_00007FFB0BC222C5
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC22414 CRYPTO_free,BIO_clear_flags,BIO_set_flags,BIO_snprintf,ERR_add_error_data,memcpy,	3_2_00007FFB0BC22414
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC284C0 CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow,	3_2_00007FFB0BC284C0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21A69 CRYPTO_free,	3_2_00007FFB0BC21A69
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC41C60 CRYPTO_free,CRYPTO_strdup,	3_2_00007FFB0BC41C60
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC57C90 CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC57C90
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC67C50 CRYPTO_free,CRYPTO_strndup,	3_2_00007FFB0BC67C50
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC57BF0 CRYPTO_free,	3_2_00007FFB0BC57BF0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC71BE0 CRYPTO_malloc,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,CRYPTO_free,	3_2_00007FFB0BC71BE0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC6DBE0 CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC6DBE0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21122 CRYPTO_free,	3_2_00007FFB0BC21122
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21069 CRYPTO_free,	3_2_00007FFB0BC21069
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21398 EVP_MD_CTX_new,EVP_PKEY_new,EVP_PKEY_assign,EVP_PKEY_security_bits,DH_free,EVP_PKEY_get0_DH,EVP_PKEY_free,DH_get0_key,EVP_PKEY_get1_tls_encodedpoint,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,EVP_PKEY_size,EVP_DigestSignInit,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,CRYPTO_free,EVP_MD_CTX_free,	3_2_00007FFB0BC21398
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2129E CRYPTO_THREAD_run_once,	3_2_00007FFB0BC2129E
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21163 EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC21163
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21A0A CRYPTO_zalloc,memcpy,memcpy,memcpy,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC21A0A
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC5FAE0 CRYPTO_realloc,	3_2_00007FFB0BC5FAE0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC57A70 CRYPTO_free,	3_2_00007FFB0BC57A70
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2176C CRYPTO_free,CRYPTO_malloc,memcmp,CRYPTO_memdup,	3_2_00007FFB0BC2176C
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC22063 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	3_2_00007FFB0BC22063
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC218DE CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	3_2_00007FFB0BC218DE
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC216F4 CRYPTO_malloc,CRYPTO_THREAD_lock_new,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,ERR_put_error,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	3_2_00007FFB0BC216F4
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC27A50 CRYPTO_free,	3_2_00007FFB0BC27A50
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC4FA54 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	3_2_00007FFB0BC4FA54
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC47A10 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	3_2_00007FFB0BC47A10
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC6BA00 X509_get0_pubkey,CRYPTO_malloc,RAND_bytes,EVP_PKEY_CTX_new,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_PKEY_CTX_free,	3_2_00007FFB0BC6BA00
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC45A07 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	3_2_00007FFB0BC45A07
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC679C0 CRYPTO_free,CRYPTO_memdup,	3_2_00007FFB0BC679C0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC539C0 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	3_2_00007FFB0BC539C0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC210FF CRYPTO_zalloc,ERR_put_error,ERR_put_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_put_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	3_2_00007FFB0BC210FF
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC79990 CRYPTO_malloc,EVP_CIPHER_CTX_new,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,EVP_CIPHER_CTX_iv_length,EVP_CIPHER_iv_length,RAND_bytes,EVP_sha256,EVP_EncryptUpdate,EVP_EncryptFinal,HMAC_Update,HMAC_Final,	3_2_00007FFB0BC79990
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC8D990 BN_num_bits,CRYPTO_malloc,BN_bn2bin,BN_clear_free,BN_clear_free,CRYPTO_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,	3_2_00007FFB0BC8D990
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21DCF CRYPTO_malloc,CRYPTO_mem_ctrl,OPENSSL_sk_find,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error,OPENSSL_sk_push,CRYPTO_mem_ctrl,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error,	3_2_00007FFB0BC21DCF
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21235 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	3_2_00007FFB0BC21235
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC3E090 CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	3_2_00007FFB0BC3E090
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC220B8 CRYPTO_free,CRYPTO_malloc,memcpy,	3_2_00007FFB0BC220B8
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21C8F CRYPTO_free,CRYPTO_memdup,	3_2_00007FFB0BC21C8F
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC214FB EVP_PKEY_get1_tls_encodedpoint,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	3_2_00007FFB0BC214FB
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC3A000 CRYPTO_free,CRYPTO_strndup,	3_2_00007FFB0BC3A000
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC216F9 CRYPTO_free,	3_2_00007FFB0BC216F9
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC2DFA0 CRYPTO_free,	3_2_00007FFB0BC2DFA0
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC211B3 EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	3_2_00007FFB0BC211B3
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC21C99 HMAC_CTX_new,EVP_CIPHER_CTX_new,EVP_sha256,HMAC_Init_ex,EVP_aes_256_cbc,HMAC_size,EVP_CIPHER_CTX_iv_length,HMAC_Update,HMAC_Final,CRYPTO_memcmp,EVP_CIPHER_CTX_iv_length,EVP_CIPHER_CTX_iv_length,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,	3_2_00007FFB0BC21C99
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC210F5 EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_new,RSA_pkey_ctx_ctrl,CRYPTO_free,EVP_MD_CTX_free,EVP_MD_CTX_free,	3_2_00007FFB0BC210F5
Source: C:\Users\user\Desktop\grass.exe	Code function: 3_2_00007FFB0BC71F50 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_00007FFB0BC71F50

Source: grass.exe, 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmp, _brotli.cp310-win_amd64.pyd.0.dr	String found in binary or memory: http://.css
Source: grass.exe, 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmp, _brotli.cp310-win_amd64.pyd.0.dr	String found in binary or memory: http://.jpg
Source: grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: grass.exe, 00000000.00000003.1372479234.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372633631.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372714595.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371651052.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379416969.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1378325481.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372106670.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371876072.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B8D000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372801356.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B8C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372998674.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371125051.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1377710073.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372878642.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: grass.exe, 00000000.00000003.1372479234.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372633631.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372714595.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371651052.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379416969.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1378325481.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372106670.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371876072.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B8D000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372801356.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372998674.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371125051.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1377710073.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372878642.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: grass.exe, 00000000.00000003.1372479234.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372633631.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372714595.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371651052.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379416969.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1378325481.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372106670.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371876072.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372801356.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372998674.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371125051.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1377710073.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372878642.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: grass.exe, 00000000.00000003.1372479234.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372633631.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372714595.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371651052.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379416969.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B89000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1378325481.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372106670.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371876072.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372801356.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B8C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372998674.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371125051.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1377710073.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372878642.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: grass.exe, 00000000.00000003.1372479234.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372633631.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372714595.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371651052.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379416969.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B89000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1378325481.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372106670.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371876072.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B8D000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372801356.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B8C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372998674.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371125051.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1377710073.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372878642.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: grass.exe, 00000000.00000003.1372479234.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372633631.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372714595.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371651052.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379416969.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1378325481.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372106670.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371876072.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B8D000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372801356.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372998674.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371125051.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1377710073.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372878642.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: grass.exe, 00000000.00000003.1372479234.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372633631.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372714595.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371651052.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379416969.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1378325481.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372106670.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371876072.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372801356.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372998674.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371125051.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1377710073.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372878642.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _overlapped.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: grass.exe, 00000000.00000003.1372479234.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372633631.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372714595.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371651052.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379416969.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1378325481.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372106670.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371876072.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B8D000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372801356.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372998674.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371125051.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1377710073.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372878642.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: grass.exe, 00000003.00000002.2628633488.00000248F28A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: grass.exe, 00000003.00000002.2628541987.00000248F26A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: grass.exe, 00000003.00000002.2627913587.00000248F1A4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: grass.exe, 00000003.00000002.2630277885.00007FFB0BA85000.00000002.00000001.01000000.00000019.sdmp, _brotli.cp310-win_amd64.pyd.0.dr	String found in binary or memory: http://html4/loose.dtd
Source: grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://httpbin.org/post
Source: grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B8D000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372801356.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372998674.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371125051.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1377710073.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372878642.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr, libssl-1_1.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: grass.exe, 00000000.00000003.1372479234.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372633631.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372714595.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371651052.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379416969.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B89000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1378325481.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372106670.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371876072.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372801356.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B8C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372998674.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371125051.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1377710073.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372878642.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: grass.exe, 00000000.00000003.1372479234.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372633631.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372714595.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371651052.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379416969.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B89000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1378325481.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372106670.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371876072.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B8D000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372801356.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B8C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372998674.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371125051.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1377710073.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: grass.exe, 00000000.00000003.1372479234.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372633631.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372714595.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371651052.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379416969.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1378325481.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372106670.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371876072.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372801356.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372998674.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371125051.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1377710073.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372878642.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: grass.exe, 00000003.00000002.2628273752.00000248F23A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://python.org
Source: grass.exe, 00000003.00000002.2628108784.00000248F21A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://python.org/
Source: grass.exe, 00000003.00000002.2628273752.00000248F23A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://python.org:80
Source: grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: grass.exe, 00000000.00000003.1372479234.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372633631.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372714595.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371651052.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379416969.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1378325481.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372106670.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371876072.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372329360.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1375786171.0000016256B8D000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372801356.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1373137867.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372998674.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1371125051.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1377710073.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1379612810.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1372878642.0000016256B7F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: grass.exe, 00000003.00000002.2628346347.00000248F24AE000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F24B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: grass.exe, 00000003.00000003.1394207526.00000248F24A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://127.0.0.1:8443
Source: grass.exe, 00000003.00000002.2628273752.00000248F23A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.getgrass.io/login
Source: grass.exe, 00000003.00000002.2628108784.00000248F222D000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628778138.00000248F2B00000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue37179
Source: grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
Source: grass.exe, 00000003.00000002.2628778138.00000248F2B00000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
Source: grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
Source: grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/glossary.html#term-coroutine-function
Source: grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/glossary.html#term-file-object
Source: grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1391979573.00000248F2623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html
Source: grass.exe, 00000003.00000002.2628778138.00000248F2B5C000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
Source: grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/functions.html#callable
Source: grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F00DD000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F19C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F00DD000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F1A4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F00DD000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F19C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F00DD000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F1A4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F1A4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F1A4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F19C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F1A4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: grass.exe, 00000003.00000002.2627789352.00000248F0108000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F00DD000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388498007.00000248F0109000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388628958.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388989417.00000248F012C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html#contexts-and-start-methods
Source: grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/re.html#re-objects
Source: grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/string.html#format-string-syntax
Source: grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://filepreviews.io/
Source: grass.exe, 00000003.00000002.2628108784.00000248F222D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.co
Source: grass.exe, 00000003.00000002.2628706141.00000248F29C0000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2629146363.00000248F3104000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Qix-
Source: grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Qix-/better-exceptions
Source: grass.exe, 00000003.00000002.2627789352.00000248F0108000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388498007.00000248F0109000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627789352.00000248F008F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388628958.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388989417.00000248F012C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: grass.exe, 00000003.00000002.2628778138.00000248F2B00000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
Source: grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/erezinman
Source: grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/erezinman/loguru-config
Source: grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs)
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1328)
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1329)
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1330)
Source: grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1391979573.00000248F2623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/136
Source: grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/251
Source: grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1391979573.00000248F2623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/428
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
Source: grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627913587.00000248F1A4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: grass.exe, 00000003.00000003.1388989417.00000248F012C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: grass.exe, 00000003.00000002.2627789352.00000248F0108000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388498007.00000248F0109000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627789352.00000248F008F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388628958.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388989417.00000248F012C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: grass.exe, 00000003.00000002.2628778138.00000248F2B00000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F25E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/28073
Source: grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sdispater
Source: METADATA.0.dr	String found in binary or memory: https://github.com/sponsors/hynek
Source: grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/sponsors/hynek).
Source: grass.exe, 00000003.00000002.2627789352.00000248F0108000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383127563.00000248F013A000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388498007.00000248F0109000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627789352.00000248F008F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1383179962.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388628958.00000248F012C000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388989417.00000248F012C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://hynek.me/articles/import-attrs/)
Source: grass.exe, 00000003.00000002.2628346347.00000248F24F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://klaviyo.com/
Source: grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394126354.00000248F2DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pendulum.eustace.io/docs/#tokens
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://peps.python.org/pep-0649/)
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://peps.python.org/pep-0749/)-implementing
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://pypi.org/project/attrs/)
Source: grass.exe, 00000003.00000002.2631382922.00007FFB0C36F000.00000002.00000001.01000000.00000004.sdmp, python310.dll.0.dr	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
Source: grass.exe, 00000003.00000002.2629131467.00000248F2E35000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628866343.00000248F2D3F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F24AE000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F24B0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2629146363.00000248F3030000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627789352.00000248F008F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/Vpooopooo
Source: grass.exe, 00000003.00000002.2629131467.00000248F2E35000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628866343.00000248F2D3F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F24AE000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F24B0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2629146363.00000248F3030000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627789352.00000248F008F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/inanitynoupcase
Source: grass.exe, 00000003.00000002.2629131467.00000248F2E35000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628866343.00000248F2D3F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628346347.00000248F24AE000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1394207526.00000248F24B0000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2629146363.00000248F3030000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2627789352.00000248F008F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/wibuairdrop142
Source: grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).
Source: grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
Source: METADATA.0.dr	String found in binary or memory: https://www.attrs.org/
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/)
Source: grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/
Source: grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/FilePreviews.svg
Source: grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Klaviyo.svg
Source: grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Tidelift.svg
Source: grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Variomedia.svg
Source: grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/latest/names.html)
Source: grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html
Source: METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)
Source: grass.exe, 00000000.00000003.1374548986.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374686499.0000016256B8F000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes)
Source: grass.exe, 00000000.00000003.1376523848.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, libffi-7.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: grass.exe, 00000000.00000003.1376661483.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2630678270.00007FFB0BCCB000.00000002.00000001.01000000.0000000D.sdmp, grass.exe, 00000003.00000002.2631138306.00007FFB0C019000.00000002.00000001.01000000.0000000C.sdmp, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: grass.exe, 00000003.00000002.2628866343.00000248F2CB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: grass.exe, 00000000.00000003.1375069994.0000016256B81000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1388164897.00000248F21C1000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000003.00000002.2628201852.00000248F22A0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: grass.exe, 00000003.00000002.2627913587.00000248F19C0000.00000004.00001000.00020000.00000000.sdmp, grass.exe, 00000003.00000003.1387950192.00000248F21B3000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: grass.exe, 00000000.00000003.1374806302.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374716120.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374548986.0000016256B88000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374895066.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, grass.exe, 00000000.00000003.1374586884.0000016256B84000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://www.variomedia.de/

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report grass.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI75522\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI75522\_asyncio.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\_brotli.cp310-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\_multiprocessing.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\_overlapped.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\_uuid.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_helpers.cp310-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_http_parser.cp310-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_http_writer.cp310-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\aiohttp\_websocket.cp310-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI75522\attrs-24.2.0.dist-info\INSTALLER

C:\Users\user\AppData\Local\Temp\_MEI75522\attrs-24.2.0.dist-info\METADATA

Windows Analysis Report
grass.exe

Function 00007FF69E197E40 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Function 00007FF69E1B6E10 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Function 00007FF69E1B7B74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00007FF69E1B708C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Function 00007FF69E191930 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Function 00007FF69E1915E0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Function 00007FF69E197AC0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON